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1 Executive Summary 


A new form of terrorism emerged in 2019. Incubated by a globalised, toxic, anonymous online culture, 
incitement to hate now all too frequently leads to violent extremism that manifests offline, and has cost 
the lives of dozens of innocents, including children. Participants and spectators of this newly forged 
online culture encourage, support and celebrate the serious crimes that they commit, and revel in the 
chaos and destruction they inflict. 


There have been four terrorist attacks in 2019 attributable to the rise to prominence of this new form of 
online extremism. Two attacks occurred in the United States, one in New Zealand, and most recently in 
Germany. The minority groups that have been the targets of these attacks have varied, but all have 
consistently been linked to an online culture based primarily on participatory platforms (i.e., forums 
such as reddit), but especially imageboards (image-based online discussion forums) such as 4chan and 
8chan. Indeed, at the core of this toxicity and violence is a subculture borne out of the now notorious 
board ‘/pol/’ (short for “politically Incorrect”). Originally a creation designed to quarantine the neo-Nazis 
that plagued 4chan, /pol/ has become a cultural force in and of itself, and is now a key driving force with 
substantial momentum, as well as influence that has spread across multiple boards and sites. 


The attacks in Christchurch (New Zealand), Poway (California, USA), El Paso (Texas, USA) and Halle 
(Germany) each began with a post to an imageboard that announced that the attack was imminent, and 
provided links to both a manifesto and a livestream feed to watch the attack unfold. 


This report opens with an introduction that establishes the links between the attacks, the image board 
community and /pol/ in particular. As we explain, this is a new source of extremism that has now 
already led to four deadly terrorist attacks and there is no reason to believe it will not result in further 
deadly attacks. We provide an introduction to and overview of this hateful online subculture, 
highlighting key issues that must be understood to tackle this theat. The report then introduces the 
Halle attack and provides an analysis of the attacker and the online elements of his attack. We look at 
the response on /pol/ and the spread of the attacker’s material online. Next discuss the response by 
technology companies, GIFCT and the Australian Government (as we are an Australian charity) to limit 
the spread of this dangerous content. This is accompanied by a discussion of our observations of 
responses to the Christchurch Call. The report continues with a more detailed examination of the 
antisemitic themes that emerge from the attack, as well as a more in-depth look at /pol/, and the image 
board community. 


Throughout this report, we offer recommendations for a range of stakeholders that can be implemented 
to improve the efficacy of dealing with this new form of terrorism. Although the management of these 
incidents are gradually improving, there remains a substantial gap between the promises for greater 
action which have been made publicly and the reality. It is in this gap where incitement festers, 
radicalisation processes proceed unabated, and the risk of further attacks grow. Any effective response 
will require the active participation, cooperation and investment of governments, technology 
companies, and civil society as partners with a shared interest in combating what has become a 
significant threat to our globalised societies. 


2 Summary of Recommendations 


The following sections summarise recommendations that appear with background explanation and 
context throughout this report. 


2.1 Recommendations to Create a Partnership Between Industry and Government 


Number 
19 


Page 
45 


Recommendation 

Serious hate speech, that which makes threats of violence or incites either violence 
or hatred, should be immediately reported to authorities. Other forms of hate 
speech should be removed by the platform, but a log of the incident including the 
users account and IP address should be recorded. Users should be informed when a 
platform takes action against them and should be warned repeated breaches could 
lead to a report being issued to authorities. Where platform sanctions prove 
ineffective at altering behaviour, the history of breaches and IP address of the user 
should be referred to authorities. 


20 


45 


Once a user has been referred to authorities, a summary of any further hate speech 
incidents involving that user should be notified to authorities periodically (e.g. 
monthly) by the referring platform. 


21 


45 


Once a user has been referred to authorities, the authorities should seek to convert 
the IP address into details of the accountholder and add it to the record. Where the 
account holder is a company, the company should be notified with a request to 
identify the specific user. 


22 


45 


Where a company cannot provide information on the person who committed a 
breach of the law against serious or repeated hate speech, assistance should be 
provided. Where a company will not provide information on the person who 
committed a breach of the law against serious or repeated hate speech, the 
company itself should be liable to corporate fines. 


23 


45 


Users referred to authorities by platforms for repeated breaches that do not involve 
incitement to hate or violence should initially be issued a warning, potentially after a 
discussion with authorities in which their actions are discussed. Further breaches 
should lead to escalating fines. If fines fail to provide a deterrent more serious 
measures including imprisonment should be available. 


24 


45 


Legal exemptions should be provided for researchers from government agencies and 
departments, academia and civil society engaged in testing the effectiveness of both 
platform and government agency responses. Such exemptions may require prior 
approval of the research by one or more authorised people or agencies who are 
independent of the enforcement system. 


2.2 Recommendations for Content Services 


Number Page Recommendation 

3 16 All services that allow users to upload or post content should have clearly visible 
mechanisms for reporting to the service provider any content that violates the terms 
of services. 

18 43 All companies that allow hosting of user generated content should have a process to 


receive reports from the public related to material promoting terrorism and this 
process should ensure rapid review. 


16 


All services that allow users to upload or post content should allow content to be 
reported anonymous to the service provider and by anyone who can see the 
content. If content is visible without having an account, then it should be reportable 
without having an account. 


16 


To assisting with lawful counter terrorism investigations, all services that allow users 
to upload or post content should maintain logs for at least 24 hours. Where a user 
reports content, log details related to the original uploader / poster should be 
maintained for a further period of at least 7 days. 


19 


Livestreaming and video hosting sites should provide reporting options that allow 
the rapid identification, and a priority response, to reports of actual violence, 
extremism or unfolding crime. 


19 


Platforms should on a regular basis publish target response times and actual average 
response times to user reports that are made and classified into the category they 
use to capture details of violent extremist content. 


11 


35 


When a violent extremist attack is livestreamed the platform that was used to 
stream the incident and / or host the initial video of the incident should provide 
transparency on exactly when the livestream and/or video was first reported to 
them and when exactly they acted to remove it. 


12 


35 


Platforms should take all reasonable steps to facilitate and encourage the reporting 
of material depicting and promoting violent extremism, as well as all other 
reasonable steps to identify such material themselves. They should expeditiously 
remove such material once they become aware of it. Provided the above steps are 
taken, there should be a clear safe harbour protecting platforms from liability for 
material they are unaware they are hosting. 


36 


92 


Hosting services that do not outright prohibit the use of their services to incite hate, 
should at a minimum ensure they don’t serve content inciting hate to users in 
countries where such incitement is unlawful. 


2.3 Recommendations for Suppliers to Content Services 


Number Page Recommendation 

1 14 Where an image board is hosted in country and the site, or a board within it, actively 
promotes hate speech which is unlawful in that country, the hosting provider once it 
is aware of this should take action to terminate the hosting. 

2 14 Where a domain name is registered in a country, and the owner actively uses the 
site at that domain for the purpose of promoting hate speech which is unlawful in 
that country, the domain name should be terminate by the domain name registrar. 

31 87 Decisions by technology companies not to do business with a site should be general 
enough that a change to the ownership, brand, domain name or IP address will not 
circumvent the ban. 

33 88 All companies providing Internet infrastructure should have clear terms of service 


which prohibit the use of their service for inciting hate or violence. They should also 
give notice that the service may be terminate without notice for serious breaches of 
this rule. Companies may further wish to require that any customer they provide a 
service to includes a similar statement in its terms of service. 


2.4 Recommendations for Law Makers 


Number Page Recommendation 

6 17 Laws and policies designed to prevent the spread of extremist material need to be 
flexible enough to cover content consisting of a link which directly or indirectly will 
lead to the material. 

37 92 Governments should consider law reforms to create a system of sanctions that could 
be imposed on companies outside their jurisdiction who, after suitable notice, 
continue to provide unlawful content inciting hatred or violent extremism to users in 
that country in breach of the country’s law. Such law reform could also create 
sanctions that impose penalties for any company within the country’s jurisdiction 
who engaged in business with a company on the sanctions list. 


2.5 Recommendations for Executive Government 
Number Page Recommendation 


34 89 Governments continue to contribute to the costs of security for Jewish communal 
institutions and provide additional support at times of increased risk such as during 
Yom Kippur. 

32 88 Decisions by governments to restrict access to a site should be robust enough that a 


change to the ownership, brand, domain name or IP address of the banned site will 
not circumvent the restriction. Government may need to monitor and update 
identification details to enforce such restrictions. 


2.6 Recommendations for Civil Society 


Number Page Recommendation 
17 43 Civil society organisations should redact or avoid naming hosting services that are 
making terrorist content available, but should confidentially report such content to 
key stakeholders in government, industry and civil society. 
9 22 Those responding to antisemitic manifestations and incidents should make use of 
the International Holocaust Remembrance Alliance’s Working Definition of 
Antisemitism. 


2.7 Recommendations for Australia 


Number Page Recommendation 

10 22 Australia should join with other IHRA member countries in formally adopt the 
International Holocaust Remembrance Alliance’s Working Definition of Antisemitism 
for domestic use. 

25 50 The eSafety Commissioner should refer all unclassified Abhorrent Violent Material 
for classification by the Classification Board. This should become a standard part of 
the process when new Abhorrent Violent Material is identified. 

26 50 The eSafety Commissioner should refer the manifesto documents from the terrorist 
attacks in Halle, Poway and El Paso to the Classification Board as was done in the 
case of Christchurch. 


27 


50 


The eSafety Commissioner should announce when terrorist related material that has 
a risk of going viral has been given an RC rating and should advice the public to 
report any online copies to the eSafety Commissioner and not to share it. 


28 


50 


In Australia consideration should be given to creating a civil penalty regime for 
sharing material classified RC that promotes terrorism. Suitable exemptions should 
apply for those acting reasonably and in good faith for the purpose of journalism, 
scientific research or law enforcement. 


29 


50 


The Classification Board should restore the previous tool that allowed more detailed 
interrogation of Classification Board decisions, specifically, it should allow all 
decisions in a given period for a particular classification to be listed. 


30 


50 


The Classification Board should ensure either the title or a useful description is 
provided for material which is given an RC classification. This is necessary as the 
public can’t comply with a ban if the banned content cannot be identified. 


2.8 Recommendations for Specific Companies or Organisations 


Number 
13 


Page 
40 


Recommendation 

Google should commit to supporting the Christchurch Call across all parts of the 
business without exception. This includes preventing Google’s search engine being 
used to access material promoting terrorism. 


14 


42 


Through the Global Internet Forum to Counter Terrorism (GIFCT), technology 
companies should provide a contact mechanism that is staffed 24/7 and available to 
assist any platform whose technology is abused to share manifestos or live 
streaming. 


15 


43 


Access to the Terrorist Content Analytics Platform should be available to researchers 
after they are vetted to ensure they represent legitimate research efforts in 
government, academia or civil society. 


16 


43 


The Terrorist Content Analytics Platform or a similar service should offer a tool for 
archiving and preserving online content for use by law enforcement and in legal 
proceedings. Adding content should be available to the public, but accessing 
archived content should be restricted to vetted people from government, academia 
and civil society. 


2.9 Recommendations for the Public 


Number 


Recommendation 


38 


Page 
96 


The public are urged not to share content from terrorist attacks such as manifestos 
or videos. If seen, this content should be reported to the relevant authorities, in 
Australia this being the eSafety Commissioner. 


The following recommendation was flagged as particularly controversial: 


35 


91 


Content services should create mechanisms that enable them to restrict access to 
specific content on their service for users from countries where that content is 
illegal. This will ensure content services have the technical capacity to respect 
national sovereignty and comply with national laws. There may be exceptional 
circumstances where a content service refuses to comply with national laws, for 


example, if the national laws conflict with customary international law, international 
treaties to protect human rights, or legal obligations in the content services own 
jurisdiction. 


This goes to the question of state sovereignty and the role of Internet technology as a disrupter. Foreign 
interference that undermines a government’s power of control is justifiable in circumstances where the 
power is being used contrary to universal human rights. Other cases are more controversial as they may 
advance the interests of some states against the interests of others. Questions of cyber dissidents, 
whistle blowers and Smart Power come in to play. 


vi 
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3 Introduction: Violent Extremism from a Toxic Online Culture 


In 2019 we saw the rise of a new form of violent extremism. It manifests as deadly violence that targets 
minorities in the real world, but is the result of a toxic online sub-culture of hate created on the Internet, 
spread via the Internet and whose manifestations are designed for its own Internet based audience. 


The attack on the synagogue in Halle was the fourth in a series of similar attacks. The first was an attack 
during Friday prayers on two mosques in Christchurch, New Zealand.‘ The second was an attack ona 
synagogue in Poway, near San Diego in the United States.* The third attack in a Walmart car park in El 
Paso, Texas in the United States, during which immigrants, specifically Mexicans and Hispanics more 
generally, we the primary target.? This most recent attack in Halle was aimed primarily at the Jewish 
community, was planned at a time and location to maximize Jewish casualties, but women, Muslims, 
Christians, Communists, people of colour, police officers and “traitors” were also on the list of targets. 


Though attacking a range of different targets, there is a direct connection between the attacks. The 
Poway attacker’s manifesto makes direct reference to Brenton Tarrant, the individual who carried out 
the attack in Christchurch. The Poway attacker writes in his manifesto that he “scorched a mosque in 
Escondido with gasoline a week after Brenton Tarrant’s sacrifice” and that he spray painted “For 
Brenton Tarrant -t. /pol/” in the mosque’s parking lot. He continues, “Tarrant was a catalyst for me 
personally. He showed me that it could be done.” The El Paso attacker’s manifesto also references the 
Christchurch attack opening with, “In general, I support the Christchurch shooter and his manifesto”. 


The Halle attack does not make a direct reference to the previous attacks but comes from the same 
online community and follows the same approach taken by the previous attackers. 


The four attacks are examples of violent extremism resulting from online self-radicalised. This is made 
explicit in the Christchurch manifesto, in which the author writes, “From where did you 
receive/research/develop your beliefs? The internet, of course. You will not find the truth anywhere 
else.” This is, of course, an oversimplification. It was not simply a matter of searching the Internet which 
radicalised these individuals, but rather the experience of becoming embedded within a toxic and fully 
anonymous online community. 


That community, originally created on 4Chan, is spread across a range of sites and platforms. It is a 
culture which has coordinated significant cyberbullying and harassment campaigns, encouraged people 
to commit suicide while streaming live, and which calls for race wars and genocide. What started as a 
culture of irony designed to shock new visitors and celebrate freedom of speech online, gradually 
shifted to the serious promotion of hate, incitement to violence and an ideology of right-wing 
extremism. It has become a culture where the response to a post announcing an intended terrorist 
attack is to wish the poster luck and a “high score”, that is, a higher number of casualties. 


1 Andre Oboler, New Zealand Terrorist Attack (Online Hate Prevention Institute, 2019) < https://ohpi.org.au/new- 


zealand-terrorist-attack/>. 
2 Andre Oboler, San Diego Synagogue Attack (Online Hate Prevention Institute, 2019) <https://ohpi.org.au/san- 


diego-synagogue-attack/>. 


3 Queenie Wong and Richard Nieva, “El Paso massacre shines light on 8chan, a racist troll haven”, CNet, 6 August 
2019 <https://www.cnet.com/news/el-paso-shooting-shines-light-on-8chan-a-racist-troll-haven/>. 


Readily available equipment and online services have been used to livestreaming and then share videos 
of the attacks. The approach, first used in the Christchurch attack, is modelled on online gaming, 
particularly first-person shooters. It allows others to participate by either watching live or viewing and 
sharing videos of the attack once it concludes. This glorifies the attacker and gives them an audience for 
their “achievement”. The Halle attacker took this one step further with a page in the manifesto listing a 
range of game like “achievements” including “Chosen to die”, where the goal was to “Kill a jew” [sic], 
“Think of the children!” where the goal was to “Kill a kikelett” (a derogatory created in this sub-culture 
for a Jewish child), “Cultural Appropriation”, where the goal was to “Stab a muslim” [sic] and “Crossed 
out”, where the goal was to “Kill a Christian” [sic]. 


The attacks were all announced on image boards. The first three on the “politically incorrect” board 
/pol/ on 8chan. 8chan has since been forced offline and the Halle attack was announced on an image 
board called Meguca.org. They contain messages directed to those they see as their compatriots within 
this culture of hate. The attacker in Halle wrote in a document pointing to his livestream “Thank you for 
all the good time anon” and referenced 8chan specifically. The El Paso attacker posted on 8Chan 
referring to the readers as “brothers”. The Poway post begins, “It’s been real dudes. From the bottom of 
my heart thank you for everything. Keep up the infographic redpill threads”. The Poway manifesto says, 
“To the true anons out there (you know who you are). You are the product of /pol/—the product of 
unadulterated truth. You are my brothers and the best dudes out there”. The Christchurch post 
describes members of this sub-culture as “top blokes and the best bunch of cobbers a man could ask 
for” and begins with the words, “Well lads, it’s time to stop shitposting and time to make a real life 
effort post”. *The attacks, with their livestream feeds promoted to the online community in /pol/ were 
seen by the attackers as a continuation of the online discussion, an ultimate contribution to a discussion 
with calls to be ever more hateful and more extreme. 


The actions of the attacker were not meant to end the discussion, but to keep it going. The Christchurch 
post called on the online community to “do your part by spreading my message, making memes and 
shitposting as you usually do”. The Halle post called for a copy of the manifesto accessed through the 
Dark Web to be seeded, a call for those who download it to keep their clients open and host copies so 
others can more readily access it. The Poway post includes a list of songs the attacker planned to play, 
provided “in case they take down my livestream too soon”, which he describes as “very meme-able 
songs” saying “you should have no problem”. This is an indirect call to make and spread memes about 
the attack. In the last line of his post he declares “Meme magic is real” reinforcing this. 


The manifestos posted along with the live streams sought to incite further attacks. The Christchurch 
manifesto gave as one reason for the attack, “To show the effect of direct action, lighting a path forward 
for those that wish to follow”. It also encouraged readers to “Make your plans, get training, form 
alliances, get equipped and then act” and to remove any doubt it adds, “the time for a political solution 
has long since passed” making it clear this is a call to use violence for a political purpose — the definition 
of terrorism. The Poway manifesto says “I have complete trust and certainty that all of you after reading 
this will begin planning your attack on the enemy—and you'll attack again, and again, and again— until 
either we win, or we die. | know you will do this because you’re true anons.” The Halle manifesto 
directly called on readers to kill Jews, Muslims, Christians, Communists, people of colour and traitors. 


4 Andre Oboler, New Zealand Terrorist Attack (Online Hate Prevention Institute, 2019) < https://ohpi.org.au/new- 
zealand-terrorist-attack/#attacker>. 


The last page of one of the documents it jokingly offers a free cat-girl to those that become a “techno- 
barbarian” and in the fine print adds “You need to kill at least one jew to qualify”. 


It isn’t just the attackers themselves. The first comment after the post about Poway reads “Based. Get 
the high score.” That form of encouragement to someone about to carry out an attack may reinforce 
their conviction that there is a crowd of supporters and that mass murder is seen as acceptable by the 
community they have identified with. That message is also seen by others, reinforcing the attackers call 
for further attacks and making it appear like there is a silent majority backing that call. This is a toxic 
subculture with the capacity to self-perpetuate its own growth: It is extremism that justifies, validates 
and supports itself in its efforts to incite further terrorism. 


In this report, we begin with a focus on the attack in Halle, Germany. As in our past work, we will briefly 
outline the incident then examine the online post announcing the attack, the manifesto accompanying 
the attack, the technology used, the online response and the reaction of those responding to the attack 
and seeking to contain it. This will be followed by an in-depth discussion of the antisemitism present in 
attack and a more detailed discussion of the online community which has led to this extremism. 
Throughout the report we will provide recommendations for key stakeholders to help prevent the 
growth of such extremism in the future and to improve responses when incidents do occur. 


4 The Halle Attack 


On October 9, 2019, as Jews around the world gathered in synagogues for Yom Kippur prayers, the 
synagogue in Halle, Germany, became the target of a terrorist attack. 


The attacker tried to force his way in with guns and explosives. He timed his attack for Yom Kippur, the 
holiest day of the Jewish year, the day with the highest synagogue attendance. It is also the day when 
security is at its highest. It was the security precautions which kept the attacker out and the community 
safe. From inside the community, called the police, barricaded the doors and watched the unfolding 
attack through the synagogue’s CCTV monitors. 


Unable to get in, the attacker diverted to nearby targets of opportunity. A woman walking past was shot 
in the back and killed. He drove off and when he spotted a kebab shop he muttered “that’ll do” and 
proceeded to attack it. In the shop he executed a man by shooting him at point blank range. Like 
Christchurch, the attacker hung out on 8chan, posted a manifesto online and livestreamed his attack. He 
was arrested and is currently facing two counts of murder and nine counts of attempted murder. 


4.1 The Attacker 
Stephan Balliet is a 27 years old German. 


He is a Holocaust denier. His live stream opens with him making a statement denying the Holocaust. 


He is an antisemite. His attack was targeted at Jews, one part of his manifesto says "KILL ALL JEWS!" in 
size 60 font. Another part of his manifesto refers to Jews as kikes and makes use of an antisemitic 
conspiracy theory about Jewish power, he is obsessed with killing Jews saying, "If | fail and die but kill a 
single jew, it was worth it". 


He is a white supremacist. His manifesto speaks about suppressed Whites, literally "supressed Whites" 
[sic] and "anti-Whites". 


His is a misogynist. He makes misogynistic comments in the video before driving to the Synagogue. His 
manifesto repeatedly speaks about “white men” (rather than the “white race” or “white people”). He 
tells white men to “dedomesticate” themselves. 


He appears to have been a regular on 8chan. One of the documents he uploaded refers specifically to 
8chan and he wrote "Thank you for all the good time anon". In the video he describes himself as “Anon”. 
This use of Anon (short for Anonymous) is the name users appear under in 4chan / 8chan and similar 
message boards. 


He was part of the online subculture obsessed with Japanese culture. He refers to himself as a “weeb” 
(someone obsessed with Japanese culture) in the live feed. One of his manifesto document has the 
filename in Japanese characters and which contained anime. 


The German newspaper Bild described him as a Neo-Nazi. Germany’s Attorney General and Minister of 
Justice, Christine Lambrecht, described his actions as a "right-wing extremist terrorist attack". 


4.2 The Post Announcing the Attack 
The attack was announced on the meguca.org imageboard. The original posted was made at 11:57am 
(local time in Germany) on Wednesday 9th of October. The screen capture shown below shows a time 


stamp of 12:57 pm as it was captured by a person in the next timezone and the boards adjust to display 
post times in local time for all users. An archived copy showing the correct local time has been viewed. 
The post was made just 6 minutes before the first emergency call. 


The post reads (with some redactions): 


"For all of you, who live in no fun countries, this may be of interest. 

Over the past years | built and tested different improvised weapons. | found that the 
best gun to make is... All you need is a weekend worth of time and 50S for the 
materials. Cartridges can be made from... most important of all It's reliable. All other 
weapons | tested were not, ... a pain in the ass to build... 3D printed plastic lower and 
will share the files with you. Besides the .stl and freecad files for... there is a small 
guide and some pictures in it, all in all around 50mb. 

Here in the link to the upload: ... 

And here is the magnet link: ... 
| would appreciate seeding, but only if your local ZOG won't van you for it. 

Of course, there are dozens of improvised designs out there, so what's special with 
mine? Simple, | prefer live testing: https://www. twitch. tv/spilljuice" 
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Figure 1 The original post 


As shown, this was mostly about the improvised guns, though even here there is an antisemitic 
reference to ZOG and Jewish conspiracy theories. 


Once copy of the files was uploaded to the surface web, the other copy was uploaded to the Dark Net. 
This is the fourth attack from the far right in the chans that follows this approach of a post to an image 
board with a manifesto and at least an attempt to live stream. The previous attacks were in Christchurch 
(New Zealand), Poway (USA), and El Paso (USA). This is the first time with this style of attack that we 
have seen the Dark Web used as an original upload location for the manifesto. 


4.3 The Manifesto 

The archive file that was uploaded contained three separate PDF files in addition to the .stl and freecad 
files for printing parts of the weapons. The first was create on October 1, 2019 and is named in Japanese 
characters which spell out manifesto. The second with a filename of "DoKumentation" was created on 


October 2, 2019 and is described as "A short pre-action report". The third was created on October 6, 
2019 and provides the live streaming details. 


431 VOILA 
The Japanese characters spell the Japanese word "Manifesuto" which in English is "manifest". The 
addition of two more characters would convert it to the noun manifesto (X27 13 F, Hd). 


The document opens with a title "Techno-Barbarism" displayed in the custom font Moderne Fraktur, an 

Old English style of font created by another German in 1999. It is likely a reference to the tabletop game 
Warhammer 40,000 in which "Techno-barbarians is the name given to the warriors who battled over the 
ruins of Terra during the Age of Strife". 


The subtitle describes the document as a "Spiritual guide for discontent White Men" designed for the 
near future, four years from now. The message is short and in multiple different large sizes of font. First 
it calls on white men to "Dedomesticate yourself" then it directs them (in huge 60 point font) to "KILL 
ALLJEWS!". On the next page, almost as an afterthought, it adds to also kill Muslims, Christians, 
Communists, people of colour and traitors. It uses derogatory language for each group. 


The inclusion of Christians is unusual but discussion on /pol/ from around 2017 showed some people 
promoting the idea that Christianity and White nationalism were mutually exclusive. The argument 
presented was that (1) Christ was Jewish [QED], (2) the loyalty of Christians is suspect as their loyalty 
would first be to Jesus and only after to their "race", and further, they would accept non-whites so long 
as they converted. 


Some White nationalist groups have co-opted Norse mythology. We see this in one of the documents 
Balliet uploaded where he speaks of Valhalla, the place where worthy warriors go after they die in Norse 
mythology. In Melbourne, the far-right group "Soldiers of Odin Australia", an offshoot of a Finnish 
group, is an example of this connection. The groups are named after Odin a principle god, and 
specifically a war god, in Norse mythology. 


Many white nationalist groups, however, consider themselves Christian. The Christian Identity 
movement is an example of this, as is the Ku Klux Klan (KKK). Much of the far right has adopted Christian 
crusader imagery in their promotion of hate against the Muslim community. 


The third page is almost entirely blank, except for the comment "thank for reading" in regular sized font 
at the bottom of the page. Following the incitement to violent extremism the document ends with what 
looks like an advertisement with a large image, an offer and some fine print with conditions. The offer 
reads "Become a Techno-Barbarian TODAY and get a FREE* Cat-Girl". The fine print reads "*Disclaimer: 
You need to kill at least one jew to qualify. Alternatives include Fox-Girls and normal Waifus. She will 
always be loyal, so treat her good." The image features a Catgirl in a box labelled "Strategic Cat-girl 
Supplies" in Moderne Fraktur font (as used at the start of the document). The original image, which has 
been widely shared online over many years, instead has a parody of an Amazon logo with the word 
"Anyzon" in black above the curved orange arrow. 


The image is of Yukino Yukinoshita but turned into a cat girl. The character is from the Japanese light 
novel series (and later anime television series) "Yahari Ore no Seishun Rabukome wa Machigatteiru" 
(literally: "My Youth Romantic Comedy Is Wrong, As | Expected") which was judged the best Japanese 
light novel by online polls in 2014, 2015 and 2016. In the series Yukino Yukinoshita is a 16/17 year old 


student who was the founding president of the Service Club, a student club for volunteers to help those 
in need. One of her quotes is "People fail because they don’t understand the hard work necessary to be 
successful". Somewhat ironic given Balliet's attack was generally seen as a dismal failure by those he was 
trying to incite. 


As mentioned, Yukino Yukinoshita is in this instance turned into a Catgirl. Catgirls, also known as Neko or 
Nekomimi (literally "cat-ears" in Japanese), are characters in anime and manga who are girls with cat 
characteristics, often just the ears, but they may have other characteristics such as the eyes and tail of a 
cat. They are popular on 4chan and more broadly within parts of online culture. In some parts of online 
culture, particularly around the Chans (4chan / 8chan and others) the use of Catgirls can involve an 
element of gender based hate. This at one point led to ban and significant debate about the 
appropriateness of Catgirls on Reddit’s socialism community, /r/socialism. When gendered based hate is 
in play, the misogyny reduces women to "pets" designed for the largely male audience to own and use. 


The "advertisement" as a whole follows the misogynistic use of catgirls. In this instance not only is girl 
with cat like features presented as a pet, she is offered as a free giveaway. The message she will be 
"always be loyal" and should be "treated good" further promotes the idea of a pet. 


4.3.2 Read This First 
The file with the filename of “READ THIS FIRST” provided a short message “Thank you for all the good 
time anon” and a link which was labelled as the livestream. 


The live streaming account name was spilljuice. According to the dictionary, an archaic meaning of 
"spill" includes "kill" or "destroy". "Juice" is a pun on "Jews" popularised by the second "Hipster Hitler" 
cartoon from August 28th, 2010 which was spread in various forms online. The image of Hitler in the "I 
love juice" shirt is often used in isolation as a meme. 


Good morning, 
gentlemen 


Copyright © 2010 www.nipsterhitier.com 


Mein Führer, do you 
realize that it seems like | | ) 
your shirt is saying you Ñ xs é i! 
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It’s called being 
} ironic, Göring. 
|} y 
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I FUCKING LOVE JUICE. 


Figure 2 The second Hipster Hitler cartoon 


The document goes on to sarcastically thank Mark Mann, described as an 8chan Board Owner, for 
making a donation of 0.1 bitcoin (around AU$1,220). The attacker states he was at the time intending to 
target Muslims and had promised the board owner he wouldn't name him. After naming him the 
message continues by accuses him of being a "filthy jew" and says that he probably doesn't exist anyway 
and is likely from the CIA and trying to radicalise people and set them up. He concludes with further 
antisemitic stereotype. 


Mark Mann is a Jewish employee of the internet service provider NT Technology, a company owned by 
Jim Watkins who also owns 8chan.° The reference has been described as “almost certainly a cruel joke” 
but one which demonstrates the Halle attacker was “deeply familiar” with 8chan.® 


4.3.3 Dokumentation 

The file named "DoKumentation" opens with the title “a short pre-action report”. It is 11 pages long, the 
first 8 and 3/4 are a description of weapons, filming equipment and body armour. The next page anda 
quarter describe his objectives and plan. The last page is a list of “achievements” in the style of a video 
game. 


4.3.3.1 The equipment 
The first section details the weapons under sections named “on man”, “car guns” and “fallback 
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weapons”. The weapons include six different guns, a sword, a knife and a range of explosives. 


Except for the Smith-Carbine rifle (a gun patented in 1857 and used in the American civil war), the guns 
are improvised, that is, self-made, as is the ammunition. Balliet knew the weapons, particularly the guns, 
were very poor quality. He describes the range of most of his guns and the worst had a range of just 5 
meters while the best had a range of 25 meters. To put this in perspective, the average 14 to 18 year old 
boy can throw a ball about 58 meters. The two people he killed were both killed at close range. He also 
described a range of other short comings in his weapons. One gun, made with a 3D printer, was likely to 
heat up and melt from repeated use. Another was highly likely to jam and would require significant time 
and tools to fix. 


> Robert Evans and Fredrick Brennan, “The State of California Could Have Stopped 8Chan: It Didn’t”, 4 November 
2019 https://www.bellingcat.com/news/2019/11/04/the-state-of-california-could-have-stopped-8chan-it-didnt/ 
€ Ibid. 


Luty SMG 9mm Parabellum 


The explosives are described as fragmentation grenades, pipe bombs, nail bombs, smoke grenade, 
breaching charge, anti-material charge and detonation caps. As state earlier, thankfully neither the guns 
nor the explosives were able to destroy the wooden door which prevented him gaining access to his 
primary target, the synagogue and the people praying within. 


This part of this manifesto document appears designed to facilitate actions by others. Descriptions vary 
with some more focused on how the ammunition will be stored / held, while others give detailed 
specifications of the materials, sizes, chemical ratios etc. for the guns and their ammunition. For the 3D 
printed gun, he writes that "Building instruction and .stl files are in the full upload." A 3D printer was 
also used for the stock of two guns and cartridges for one. 


4.3.3.2 The Plan 

This section, taking up a page, ends with "Tldr:" (short for "too long didn't read") and a 2.5 line summary 
which highlights how Balliet wants to "Go in and kill everything" but expects he will have to improvise, 
things will go wrong, and he will end up in a situation where he will "Drive away. Kill some more." Which 
is exactly what happened. 


The summary ends "Repeat until all jews are dead or you prove the existence of Waifus in Valhalla, 
whatever comes first. Jej." This short ending has compresses the key ideas. (1) an antisemitic call not 
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only to kills Jews, but seek the complete annihilate of Jews. Something reminiscent of Hitler's final 
solution. (2) a reference to Waifus,’ a term from anime for the woman a character is fond of, (3) the 
reference to Valhalla refers to Norse mythology and is co-opted by far-right groups as part of white 
supremacy, (4) "Jej" is an ironically mistyped variation of “Kek”, both being 4chan / 8chan version of 
"lol". Its use is a deliberate effort to link back to the chans. 


The inclusion of a summary and an explicit expectation that people would not read a page about his plan 
(while there is no such summary of the previous and much longer discussion of weapons) again 
highlights where Balliet's interest lies, and it isn't in deep ideological discussions. 


Some features from the detailed explanation of the plan: 


e There is another instance of "jej" when he jokes that "For some reason (jej) the security 
measures are quite high" on the synagogue. 

e He refers to Jews as rats, a well worn antisemitic trope, saying he may try "lure the rats out". 

e He also again refers repeatedly to Jews as kikes, another antisemitic slur. 

e He also uses the antisemitic trope of "ZOG" ("Zionist Occupied Government") claiming Jews are 
responsible for governments increasing Muslim immigration. This is a common far right 
conspiracy theory, and it goes back to older conspiracy theories of Jewish power more generally 
such as those found in the forgery The Protocols of the Elders of Zion. 

e He states that he chose to attack on Yom Kippur "because even 'non-religious' jews are often 
visiting the synagogue on this date". 

e He also states this synagogue was chosen as it was the closest place where a significant number 
of Jews could be found that was close to him. 

e He originally considered attacking a mosque but decided the Jews were the greater enemy. 

e The section ends with a chilling line that promoting and encourages "White men" to kill Jews, 
with the intention of exterminating them. 


4.3.3.3. Achievements 

The final page of this part of the manifesto is a list of “achievements”. There are goals as might appear in 
a game in order to receive a reward or achievement badge. In this case, however, the goals all related to 
the planned terrorist attack. There were 26 different achievements lists. 


Technical steps to carrying out the attack 


e Upload the PDF 
e Successfully livestream the attack 


Murder particular targets 


e Murder a Jew 

e Murder 6 Jews 

e Murder a Jewish woman 
e Murder a Jewish child 


7 Waifus, Dictionary.com, seen November 2 2019 <https://www.dictionary.com/e/fictional- 


characters /waifu/> 
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e Murder a Jew using a grenade 

e Murder both a Jew and Muslim 

e Murder 3 people of colour in a specified time period 
e Murder a “traitor” 

e Murder a police office (literally “Kill a ZO0G-bot”) 

e Murder a communist 

e Murder a Christian 


Murder someone using a particular weapon 
e Murder someone with a particular homemade gun x 4 different named guns 
e Murder someone with a sword 
e Murder someone with a knife 
e Murder someone using the “secret weapon” 
e Murder someone with a particular type of explosive x 2 different types 


Serious harm 
e Stab a Muslim 


Property destruction 


e Burn down a synagogue 
e Burn down a mosque 


Accidental harm 
e Cause self-harm as a result of the homemade explosives 


Each goal was given a title as well as a description. The names are a range of puns and racist memes. The 
goal to kill 6 Jews, for example, was labelled “Anudda Shoa” a reference to the Holocaust and the 6 
million Jews who were murdered by the Nazis. The goal of killing a Jewish woman is titled “Gender 
Equality”, an ironic title given the rejection of feminism in particular and equality general by the attacker 
and this subculture. 


4.4 Technology the Attacker Used 

The post announcing the attack was original made on the meguca.org imageboard. An archive file was 
created with 7-Zip, a free and open-source file archiver, which contained the three pdf files making up 
the manifesto as well as .stl and freecad files for 3D printing parts of the weapons. The archive file was 
uploaded to anonfile.com and the Dark Web by the attacker and the link to the archive was included in 
the original post. The live streaming was carried out via twitch.tv, a stream service for gamers which is 
owned by Amazon. The weapons and munitions were homemade and used technology in the form of a 
3D printer for some of the components. These technologies will now be examined in further detail. 
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4.4.1 The Announcement: Meguca.org 

Meguca.org is an image board loosely affiliated with 4chan’s anime board.’ The name is based on a 
meme mocking the anime Puella Magi Madoka Magica.’ Its homepage declared, “[M]eguca.org has not 
received any gag orders and there's no Patriot Act here. Sucks to live in a third world police state like the 
US”.?° Its source code repository describes it as an "anonymous realtime imageboard focused on high 
performance, free speech and transparent moderation".* A few days after the attack (at least from the 
11th of October) the site went down. 


In a series of posts in April 
¥ poll ‘Board Rules1 dresden ## Board Owner 04 Apr 2017 (Tue) 20:47 No.1966900 ¥ 


2017 the admin of /pol/ on (520 KB, 1000x1202) Tbp-homura-2 png 
Meguca discusses the site 
8 3 -e Site-wide 
and the /pol/ boards rules.* 1. No illegal content 
2. No spamming 
The global rules across all 
: megu/pol/ 
boards only banned illegal 1. No disruption 
content and spamming. The 2. No degeneracy 
3. No cancer 
/pol/ board added rules 4. No namefaggotry 
against “disruption” — We are EXPLICITLY a natsoc board, anti-degenerate, anti-semitic, pro-white. This 
P Z board does not have free speech and has no interest in entertaining bluepilled 
anything off topic or newfags 


spammy, “degeneracy” - 


The rules are intentionally vague, the board culture will define the details. Not 
used in a similar sense to that knowing what counts is not an excuse, it means you didn't lurk before posting which 
is cancer in itself 


of the Nazis themselves to 
refer to anything their Figure 3 Introduction to the rules of /pol/ on Meguca 

ideology disagreed with e.g. 

degenerate art, “cancer” - anything which can “kill” the thread/discussion,“* and “namefaggotry” - 
posted that are not made as “anonymous”. *° It described itself as “EXPLICITLY a natsoc board, anti- 
degenerate, anti-semitic, pro-white”. The board admin considered 8chan compromised and said 
“admitting you're from 4chan is a bannable offense”. 


The admin stated users should “always maintain your opsec” (operational security) and banned “Any 
links posted to any non-anonymous social communities... for any reason other than raiding”. Raids, that 
is mass attacks, on other online sites were therefore explicitly encouraged. Rather arranging to meet in 
person via the board members were told to “Organize local” highlighting a desire for people to act 
beyond the online forum. In a post about “transparency” the admin says that “Meguca's servers are in 
Paris, DNS is cloud flare” and that the Admin is a “Lat” (Latvian). The idea of it being hosted in France 


8 Ryan Broderick, “Far-Right Halle Shooter Allegedly Posted A Manifesto With Xbox-Like “Achievements” To Anime 
Message Board Before Livestreaming Attack”, BuzzFeed News, 11 October 11, 2019 
https://www.buzzfeednews.com/article/ryanhatesthis/halle-germany-shooter-meguca-anime-manifesto 

? Ibid. 

10 Ibid. 

11 https://github.com/bakape/meguca 

12 https://web.archive.org/web/20170713104204/https://meguca.org/pol/1966900 


13 https://www.tate.org.uk/art/art-terms/d/degenerate-art 
14 Adrian Chen, “Here's What 5 Million Posts on 4chan Look Like”, Gawker, 12 July 2011 


https://gawker.com/5820505/heres-what-5-million-posts-on-4chan-look-like 
145 https://www.urbandictionary.com/define.php?term=namefag 
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seems particularly strange given that country’s strong laws against antisemitism and Holocaust denial.*® 
In another post they say that “IPs are stored for 7 days”. 


Just as 8chan was seen as more extreme than 4chan, Meguca set itself up, and its /pol/ board in 
particular, to be more extreme than 8chan and explicitly neo-Nazi. On this board there was no effort to 
even pretend the racism and neo-Nazism was satirical or in jest and there was no interest in attracting 
and converting new users. This was a community designed for extremism. 


RECOMMENDATION 1: Where an image board is hosted in country and the site, or a board within it, 
actively promotes hate speech which is unlawful in that country, the hosting provider once it is aware of 
this should take action to terminate the hosting. 


RECOMMENDATION 2: Where a domain name is registered in a country, and the owner actively uses 
the site at that domain for the purpose of promoting hate speech which is unlawful in that country, the 
domain name should be terminate by the domain name registrar. 


4.4.2 The first Document Hosting Service: anonfile.com 

The anonfile.com service is an anonymous file hosting service. Users can upload files of up to 20 GB to 
the service and are then provided with a unique URL that allows the files to be downloaded.” The URL 
can then be shared with others to download the contents. There are no limits on the number of 
downloads, the bandwidth that can be used, or the length of time the file can be online.?® 


The service has a short statement on its terms of use with just 5 points. They are (in full): 


§ General 


It is strictly forbidden to spread viruses, trojans, corrupt and/or illegal material via AnonFile. Always 
check with your local laws before submitting content. 


§ Availability 


AnonFile can not guarantee full availability of the service, however, we do our best to keep the service 
as stable as possible. AnonFile disclaim all responsibility for loss of income due to downtime and/or data 
loss 


§ Logging Downloads 
We are strong advocates of privacy & do not log downloads. 
§ Administrative measures 


AnonFile administrators has the right to remove and/or permanently ban file content they find 
inappropriate. 


§ Changes 


16 Valery Engel, White Papers of Hate 2012 (Book Club Knigovek, 2014) 266-268 
<https://tandis.odihr.pl/bitstream/20.500.12389/21854/1/07980.pdf> 

1 https://anonfile.com 

18 https://anonfile.com; https://anonfile.com/faq 

1 https://anonfile.com/terms 
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This user agreement is subject to change at any time, please review this agreement before you decide to 
use the service. You are technically bound to accept this agreement by accessing/using the service. 


The terms of service claim they are “strong advocates of privacy” and for this reason “do not log 
downloads”. The makes the service particularly attractive for those engaging in illegal activity including 
terrorism. With this deliberate attempt to avoid keeping records, when law enforcement is authorised 
to access the system and investigate it, there would likely be little available evidence to assist them. 


The terms of service do forbid the use of the service “to spread viruses, trojans, corrupt and/or illegal 
material”. Terrorism is not specifically mentioned but would come under “illegal material”. The ordering 
of the prohibitions suggests the platform views sharing means of technically disrupting other systems as 
a far greater wrong than spreading illegal material. 


|” 


A link to report abuse is visible in the footer of each page. The footer reads: “Login - Register - Terms of 
Use - API - FAQ - Feedback - REPORT ABUSE”. The prominence given to report abuse is high which is 
positive. Far less positive is the abuse reporting process itself. 


Despite the terms of service stating that the platform “are strong advocates of privacy”, as shown in 
Figure 4, the reporting page states “You must provide genuine information regarding who you are, who 
you represent and which file(s) this report concerns. Note: We strongly believe in transparency toward 
our users. Therefor, [sic] by filing a report you also agree on it being attached for public viewing along 
with the takedown message in order to inform our users.””° This denies users the ability to report 
content anonymously. 


The arguments in favour of anonymous reporting of potential abuse are far stronger than arguments in 
favour of allowing anonymous hosting of files. This setup facilitates the spread of illegal content while 
inhibiting reporting of abuse. 


20 https://anonfile.com/abuse 
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f you believe some of our users has violated our Terms of Service or your intellectual property rights. 
please file a report in the form below. 


fou must provide genuine information regarding who you are. who you represent and which file(s) this 
ireport concerns. 


Vote: We strongly believe in transparency toward our users. Therefor, by filing a report you also agree 
on it being attached for public viewing along with the takedown message in order to inform our users. 


* English only. 


* All Fields Required. 


eason for reporting: Please select a reason... 


Your Full Name 


Figure 4 Abuse reporting form on anonfile.com 


RECOMMENDATION 3: All services that allow users to upload or post content should have clearly visible 
mechanisms for reporting to the service provider any content that violates the terms of services. 


RECOMMENDATION 4: All services that allow users to upload or post content should allow content to 
be reported anonymous to the service provider and by anyone who can see the content. If content is 
visible without having an account, then it should be reportable without having an account. 


RECOMMENDATION 5: To assisting with lawful counter terrorism investigations, all services that allow 
users to upload or post content should maintain logs for at least 24 hours. Where a user reports 
content, log details related to the original uploader / poster should be maintained for a further period of 
at least 7 days. 


4.4.3 The second Document Hosting Service: The Dark Web 

The attacker also uploaded the archive file with their manifesto documents and CAD files to the Dark 
Web. This is the first attack of this kind where the manifesto has been released on the Dark Web right 
from the start by the attacker, rather than being transferred to the Dark Web after it became harder to 
share through traditional websites and online services. 
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The Dark Web is a part of the Internet that can only be reached using specialised software such as The 
Onion Router (aka Tor). Content on the Dark Web is not indexed and the software used to access it has 
been designed to ensure the anonymity of both the server hosting content and the user who is 
requesting access to it.?t That includes ensuring the basic use of the service is anonymous, so a user 
requesting content doesn’t know where the server is, and the server doesn’t know who is requesting 
content from it. The servers operating in this way are known as Tor hidden services and they can be 
recognised by their address which ends in a “.onion” extension.”” The system was created to facilitate 
anonymous access to an uncensored Internet as a form of opposition to an increasing threat of Internet 
surveillance.” 


While designed to hide the location of the servers, which also makes it impossible to know what legal 
jurisdiction they are in, poor configuration can open vulnerabilities which can make it possible to 
unmasked the server and trace its IP address.” Unmasking efforts in the past have included forcing 
servers to access a particular address, allowing the owner of that address to look up the Tor hidden 
service’s IP address in their logs.” Another approach has been to examine security certificates that have 
been misconfigured and appear on the surface web, but listing Tor hidden service address.”° There have 
also been scanners like PunkSPIDER which have scanned the Dark Web for vulnerabilities.” A range of 
other attacks designed to compromise anonymity in the Dark Web have also been reported by 
researchers and as with all areas of cybersecurity it is a cycles of finding and patching vulnerabilities. At 
times knowledge of certain vulnerabilities are kept secret to they can be exploited by law enforcement 
and other government agencies. 


A shift to the Dark Web as the initial hosting point for extremist material will further complicate the 
removal of content, but will also cut down the accessibility and spread of the content. For the content to 
spread it will still be necessary to share an address hosting the content and these addresses can 
themselves be targeted for removal by governments and online platforms. 


RECOMMENDATION 6: Laws and policies designed to prevent the spread of extremist material need to 
be flexible enough to cover content consisting of a link which directly or indirectly will lead to the 
material. 


21 Joseph Cox, “This Researcher Is Hunting Down IP Addresses of Dark Web Sites”, Motherboard at Vice, 23 June 
2015 <https://www.vice.com/en_us/article/9ak7xa/this-researcher-is-hunting-down-ip-addresses-of-dark-web- 
sites> 

22 Ziyahan Albeniz, “Exposing the Public IPs of Tor Services Through SSL Certificates”, 27 November 2018 
<https://www.netsparker.com/blog/web-security/exposing-public-ips-tor-services-through-ssl-certificates/> 

3 https://www.torproject.org/about/history/ 

24 Joseph Cox, “This Researcher Is Hunting Down IP Addresses of Dark Web Sites”, Motherboard at Vice, 23 June 
2015 <https://www.vice.com/en_us/article/9ak7xa/this-researcher-is-hunting-down-ip-addresses-of-dark-web- 
sites> 

25 Ibid. 

26 Ziyahan Albeniz, “Exposing the Public IPs of Tor Services Through SSL Certificates”, 27 November 2018 
<https://www.netsparker.com/blog/web-security/exposing-public-ips-tor-services-through-ssl-certificates/> 

27 Thomas Brewster, “Hackers Scan All Tor Hidden Services To Find Weaknesses In The 'Dark Web”, Forbes, 1 June 
2015 <https://www.forbes.com/sites/thomasbrewster/2015/06/01/dark-web-vulnerability-scan/#26ddd30c6d23> 
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4.4.4 The Live Streaming and Video Hosting Service: Twitch 

In this attack Twitch (Twitch.tv), a live streaming service owned by Amazon, was used to provide the 
broadcast. Twitch describes itself as "the world's leading live streaming platform for gamers". It was 
created as a gamer focused spin off of the live streaming service Justin.tv, which was shutdown in 
August 2014 when the company decided to focus on Twitch. Though still mostly used for broadcasting 
game play, with categories dedicated to different games and other themes, there is increasing 
popularity in the non-game "Just Chatting" and "IRL" categories. Prior to this attack the biggest problem 
Twitch had was preventing adult content which is against its community standards.”® 


The attack was livestreamed on Twitch at https://www.twitch.tv/spilljuice for 35 minutes starting at 
12:00 pm Central European Time (CET).2° Three people watched the attack in this livestream. There is a 
setting in Twitch which can cause a video to be automatically generated and posted when a 
livestreaming session ends. This setting was turned on in the attacker’s account. The resulting video was 
seen by 333 people over the next 4 hours and 45 minutes since the livestream ended. The spread of the 
video greatly increased between 5:20 pm CET and 5:50 pm CET with 2200 additional visitors.*? At 5:50 
pm CET the video was removed and the “spilljuice” channel were suspended.?? 


The Twitch service has an 
EeSnaie reporting puncrion Report | 
which allows livestreams, videos, 

clips, private messages, live chat, We are going to ask you a few questions to help us investigate 
profile content, usernames, your report quickly and accurately 

channel points and rewards as Where is the problem? 

well as failure to moderate others 
to all be reported. It also provides @ 
a general option for anything else 
not covered. 


In the case of livestreaming and 
videos the second stage of 
reporting offers a range of 
categories such as “Threats, 


S other content (pronie, emotes, etc.) 


harm, or endangerment of n EE s channel points or rev 
someone” and “hate speech, 
harassment, or abuse”. 


While generally well paired, the 
urgency required in a livestream 
of real-world violence is 
significantly higher than that 
required in the case of threats. Endangerment covers a wide range of problematic behaviour from 


Figure 5 Step one in reporting on Twitch 


28 https://www.thegamer.com/twitch-banned-korean-supermodels-theyll-back, 
2 https://twitter.com/Twitch/status/1182036266344271873 

30 https://twitter.com/Twitch/status/1185200174953455620 

31 Ibid. 

32 Ibid. 
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encouraging someone to commit 
suicide through to suggestions 
which carry a risk of relatively 
minor injury. 


Report Es Video 


What would you like to report? 


Overall the Twitch reporting 
system is extensive, mature and fit 
for purpose. Depending on the ate speech, harassment, or abuse 
volume of reports in the “threats, 
harm, or endangerment of 
someone” category and the Their content is misclassif 
average speed at which Twitch can 
respond to them, there may be a 
need to introduce a new category I'm concerned for their wellbeing 
for “Real world violence, 


or endangerment of someone 


Inappropriate o 


Give me more options 
extremism or crime”. This would 
allow faster responses in the case 


unfolding real world harm. 


A further reporting step allows 
users to provide further details including links to videos if they wish. 


RECOMMENDATION 7: Livestreaming and video hosting sites should provide reporting options that 
allow the rapid identification, and a priority response, to reports of actual violence, extremism or 
unfolding crime. 


RECOMMENDATIONS 8: Platforms should on a regular basis publish target response times and actual 
average response times to user reports that are made and classified into the category they use to 
capture details of violent extremist content. 


5 Antisemitism in the Halle Attack 


The term antisemitism refers to the hatred of Jews, but its long history and many differing forms can at 
times make it difficult to identify or understand. 


The term itself was coined by German Journalist Wilhelm Marr, who between 1879 and 1880 published 
two popular pamphlets which referred to “Jews” and “Jewishness” as “Semitismus”, and 
“Antisemitismus” as opposition to the Jewish people. Marr himself was an antisemite, founding the 
Antisemiten-Lega or “League of Antisemites”, and based his beliefs on pseudoscientific theories of race 
that predated Nazi racial science.*4 While the term “Semitic” is used in linguistics for a broad group of 


33 Wilhelm Marr, Der Sieg des Judenthums tiber das Germanenthum. Vom nicht confessionellen Standpunkt aus 
betrachtet, 1879. 

Wilhelm Marr, Der Weg zum Siege des Germanenthums Uber das Judenthum, 1880. 

34 https://www.jewishvirtuallibrary.org/wilhelm-marr 
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languages,” the term antisemitic has always been exclusively about hatred of Jews.*° The spelling 
without a hyphen, antisemitism and rather than anti-Semitism, is preferred by many scholars to avoid 
confusion or obfuscation.?” 


While Marr was concerned with the race of Jews, anti-Jewish hatred well-predated him, and was often 
based on religious grounds during the Middle Ages. In Christian Europe, Jews were known as “Christ- 
Killers” for their alleged role in the death of Jesus Christ,” and even subject of fantastical accusations 
such as ‘blood libel’, which accused Jews of using the blood of Christian children in rituals.°9 


In order to aid the understanding of antisemitism, the International Holocaust Remembrance Alliance 
(IHRA), an international inter-governmental organisation, adopted the Working Definition of 
Antisemitism on 26 May 2016.” The adoption was a unanimously decision by the then 31 member 
countries.“ Australia was an observer to IHRA at the time and joined the organisation as a full member 
in June 2018.” Before discussing the specific manifestations of antisemitism in the Halle attack, we will 
introduce the Working Definition of Antisemitism in more detail. 


5.1 The IHRA Working Definition of Antisemitism 

Since it was adopted in May 2016, the IHRA Working Definition of Antisemitism has received broad 
international support. A resolution of the European Parliament calls on member states and European 
institutions to adopt the definition,*? and the definition has been formally adopted in Austria, Belgium, 
Bulgaria, Canada, the Czech Republic, France, Germany, Greece (by the Ministry of Education), Hungary, 
Israel, Lithuania, the Republic of Moldova, the Republic of North Macedonia, Romania, Scotland, 
Slovakia, Sweden, United Kingdom and the Netherlands. In the United States an almost identical 
definition is used by the State Department. 


In Australia the definition is used in an annual report on antisemitic incidents compiled by the Executive 
Council of Australian Jewry.” It has also been adopted by the Australian National Union of Students and 
a range of Students’ Unions.” 


35 Patrick R. Bennett, Comparative Semitic Linguistics: A Manual (Winona Lake, Indiana: Eisenbrauns, 1998). 

36 Spelling of Antisemitism, International Holocaust Remembrance Alliance 
https://www.holocaustremembrance.com/spelling-antisemitism 

37 Ibid. 

38 Jeremy Cohen, Christ Killers: The Jews and the Passion from the Bible to the Big Screen (New York: Oxford 
University Press, 2007). 

39 Gavin | Langmuir, Toward a Definition of Antisemitism, (LA: University of California Press, 1996) p. 216. 

40 “Working Definition of Antisemitism”, International Holocaust Remembrance Alliance, adopted 26 May 2016 
https://www.holocaustremembrance.com/node/196 

41 “Working Definition of Antisemitism” (press release), International Holocaust Remembrance Alliance, 27 June 
2016, https://www.holocaustremembrance.com/stories/working-definition-antisemitism 

42 “Australia joins International Holocaust Remembrance Alliance”, Press Release from Australia’s Minister for 
Foreign Affairs, Senator the Hon Marise Payne, 5 June 2019 
<https://foreignminister.gov.au/releases/Pages/2019/mp mr _190605.aspx> 

43 http://www.europarl.europa.eu/doceo/document/B-8-2017-0383 EN.html?redirect 


44 Julie Nathan, Report on Antisemitism in Australia 2018 (Executive Council of Australian Jewry, 25 November 
2018) <http://www.ecaj.org.au/wp-content/uploads/2018/11/ECAJ-Antisemitism-Report-2018.pdf> 

45 Gareth Milner, “First Week of University Tainted by Antisemitism and Discrimination”, AUJS, 5 March 2018 
<http://www.aujs.com.au/o week antisemitism statement> 
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The core of the IHRA Working Definition explains: 


Antisemitism is a certain perception of Jews, which may be expressed as hatred toward 
Jews. Rhetorical and physical manifestations of antisemitism are directed toward 
Jewish or non-Jewish individuals and/or their property, toward Jewish community 
institutions and religious facilities. 


It continues with several examples of different types of common manifestations of antisemitism, 

although makes it clear that antisemitism is not limited to these examples.*” The examples provided 
48 

are: 


e Calling for, aiding, or justifying the killing or harming of Jews in the name of a 
radical ideology or an extremist view of religion. 


e Making mendacious, dehumanizing, demonizing, or stereotypical allegations 
about Jews as such or the power of Jews as collective — such as, especially 
but not exclusively, the myth about a world Jewish conspiracy or of Jews 
controlling the media, economy, government or other societal institutions. 


e Accusing Jews as a people of being responsible for real or imagined 
wrongdoing committed by a single Jewish person or group, or even for acts 
committed by non-Jews. 


e Denying the fact, scope, mechanisms (e.g. gas chambers) or intentionality of 
the genocide of the Jewish people at the hands of National Socialist Germany 
and its supporters and accomplices during World War II (the Holocaust). 


e Accusing the Jews as a people, or Israel as a state, of inventing or 
exaggerating the Holocaust. 


e Accusing Jewish citizens of being more loyal to Israel, or to the alleged 
priorities of Jews worldwide, than to the interests of their own nations. 


e Denying the Jewish people their right to self-determination, e.g., by claiming 
that the existence of a State of Israel is a racist endeavor. 


e Applying double standards by requiring of it a behavior not expected or 
demanded of any other democratic nation. 


e Using the symbols and images associated with classic antisemitism (e.g., 
claims of Jews killing Jesus or blood libel) to characterize Israel or Israelis. 


4 “Working Definition of Antisemitism”, International Holocaust Remembrance Alliance, adopted 26 May 2016 
https://www.holocaustremembrance.com/node/196 

47 Ibid. 

48 Ibid. 


e Drawing comparisons of contemporary Israeli policy to that of the Nazis. 


e Holding Jews collectively responsible for actions of the state of Israel. 


The definition highlights that “criticism of Israel similar to that leveled against any other country cannot 
be regarded as antisemitic”, but that there are forms of antisemitism which manifest as a “targeting of 
the state of Israel, conceived as a Jewish collectivity”. The definition also highlights how “Antisemitism 
frequently charges Jews with conspiring to harm humanity, and it is often used to blame Jews for ‘why 
things go wrong.” 


Given the many forms antisemitism has taken throughout history, from racial to religious, political to 
personal, the IHRA’s Working Definition provides a helpful, accessible, and easy to understand aid to 
understanding the problem and classifying antisemitic manifestations. The fact it is based upon 
academic expertise and adopted in so many countries though democratic decision making further 
enhances its authority. The categories of common antisemitism outlined by the examples in the IHRA 
Working Definition will in this section of the report be applied to aspects of the Halle attack. 


RECOMMENDATION 9: Those responding to antisemitic manifestations and incidents should make use 
of the International Holocaust Remembrance Alliance’s Working Definition of Antisemitism. 


RECOMMENDATION 10: Australia should join with other IHRA member countries in formally adopt the 
International Holocaust Remembrance Alliance’s Working Definition of Antisemitism for domestic use. 


5.2 Manifestations of Antisemitic in the Halle Attack 

The antisemitic intent of the attack in Halle is clear and needs little explanation, however, a detailed 
consideration of the many antisemitic manifestations involved in the attack demonstrates the link 
between words and deeds, the link between hate speech and hate action. Understanding this link is 
important when it comes to recommendations and action to prevent further attacks. It may also have a 
bearing on the legal classification of certain expression as some expression may be considered part of 
the act of extremism rather than mere words. 


5.2.1 The objective, location and timing of the attack 

The objectives of the attack, as listed in the Dokumetation part of the manifest, was to “Kill as many 
anti-Whites as possible, jews preferred”. Under the core of the IHRA definition the words themselves 
are a “rhetorical manifestation” of antisemitism and the attempted attack was a “physical 
manifestation” of antisemitism, with both being directed against “individuals” “Jewish community 
institutions” and “religious facilities” as described in the core of the definition. 


There is a further element of antisemitism in the objective. Jews are presented as the priority target 
within what the attacker called the “anti-whites”. This is the promotion of an antisemitic conspiracy 
theory about Jewish power and more specifically the conspiracy theory of “White Genocide” which says 
the Jews are behind a plot to “destroy the white race”. The falls within the second of the examples in 


49 Julie Nathan, “As the Pittsburgh synagogue massacre shows, fears of ‘White Genocide’ are incitement to 
murder”, ABC Religion and Ethics, 29 October 2018 https://www.abc.net.au/religion/white-genocide-is- 
incitement-to-murder/10442966 
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the IHRA Working Definition which speaks of “stereotypical allegations about Jews as such or the power 
of Jews as collective... especially but not exclusively, the myth about a world Jewish conspiracy”. 


In “The Plan” part of the manifesto a synagogue is listed as the first target and this targeted is chosen 
even after consideration is given to the high security and increased difficulty involved. The choice of 
target is justified in the manifesto over other potential targets, such as a “mosque or an antifa ‘culture 
center” because “It’s the nearest location with a high population of Jews, simple as that”. 


The timing was also designed to maximize the potential for harm to Jews. The manifesto states, “the 
best day of action should be Jom Kippur, because even ‘non-religious’ jews are often visiting the 
synagogue on this date”. “Jom Kippur” is the German language spelling of Yom Kippur,°° and not an 
ironic misspelling like “jej”. Yom Kippur, also known as the Day of Atonement, is the holiest day in 
Judaism and often observed by more secular Jews who often do not observe other religious holidays, >? 
as the manifesto noted. 


The manifesto goes on to claim, “The only way to win is to cut of the head of the ZOG, which are the 
kikes”. This highlights how the choice of target was made with a deliberate and overriding aim of 
causing harm to “Jewish community institutes and religious facilities”, as per the core of the IHRA 
definition. It also repeats the second bullet point argument about “the power of Jews as a collective” 
and “the myth about a world Jewish conspiracy”, but this time goes further with a direct reference to 
“ZOG” (discussed in more detail shortly). 


The final line of the plan section in the manifesto states, “if every White Man kills just one [jew], we 
win”. When this is taken alongside the objective to prove the viability of improvised weapons and to 
“increase the moral of other suppressed Whites”, it demonstrates an intent to directly inspire further 
killings of Jews in the name of a White nationalist ideolog. This is the first example of antisemitism in the 
Working Definition, “Calling for, aiding, or justifying the killing or harming of Jews in the name of a 
radical ideology”. 


5.2.2 Racial slurs 

A number of racial slurs are evident in the manifesto. They include “spilljuice”, “filthy jew”, “Kike”, and 
“Kikelett”. The use of slurs represents “rhetorical... manifestations of antisemitism... directed towards 
Jewish... individuals” as per the Working Definition and falls under the example of “Making mendacious, 
dehumanizing, demonizing, or stereotypical allegations about Jews” as the racial slurs are connected to 
these ideas. 


As explained, “spilljuice” is a combination of an archaic word meaning “kill” or “destroy” with a pun of 
“Jews” popularised by the Hipster Hitler cartoon. The slur “filthy Jew” or “dirty Jew” in an antisemitic 
slur which suggest a physically and/or moral undesirability.** “Filthy Jew” was a theme in Nazi and Vichy 
propaganda.” Historically it is linked to an antisemitic claim that Jewish blood was dirty and would 


5 https://en.bab.la/dictionary/english-german/yom-kippur 

51 “Yom Kippur”, Society for Humanistic Judaism, https://shj.org/humanistic-jewish-life/about-the-holidays/yom- 
kippur/, viewed 3 November 2019. 

52 The top definition on urbandictionary.com for “Dirty Jew” claims there are Jews that lack a conscience or morals 
regarding business deals, which makes them “dirty”. elove, “Dirty Jew”, Urban Dictionary, 27 September 2012, 
https://www.urbandictionary.com/define.php?term=Dirty%20Jew, viewed 3 November 2019. 

53 Margaret Anne Hutton, Testimony from the Nazi Camps: French Women's Voices (Routledge, December 8, 2004) 
313. 


23 


contaminate wells and as recently as 1892 this idea led to Jews being quarantined during outbreaks of 
typhus and cholera and banned by law from German public swimming pools.” 


The term Kike is a more recent antisemitic slur and one that emerged in the United States. It first 
appeared in print in 1919 in “The American Language: A Preliminary Inquiry into the Development of 
English in the United State” and is listed as one of the “common terms of disparagement” in American 
English,” and is described as a “characteristic Americanism”.°*° The term is thought to have originated 
with illiterate Jewish migrants on Ellis Island who refused to sign with a customary “x”, associating it 
with Christianity, and instead draw a circle, known as a kikel in Yiddish.” It is thought the that 
immigration inspectors began referring to anyone who signed with a circle as a “Kikel” or “Kike”.>* In this 
context a “Kikelett” in the attackers achievement list refers to a “little Jew”, specifically a Jewish child. In 
a recent court filing the Anti-Defamation League explained that the word kike “has no singular definition 
but, rather, encapsulates and invokes the full range of anti-Semitic stereotypes, including beliefs that 


Jews are cheap, untrustworthy, conniving, powerful, rich, grasping, and malevolent toward non-Jews.”°? 


The variety of slurs used in the manifesto is an aspect of the antisemitic culture on /pol/. The results 
from the NCRI report on quantifying antisemitism online found that there was wide use of both classic 
antisemitic slurs and newly invented ones. 


5.2.3 The Greedy Jew trope 

In the READ THIS FIRST document, the attacker spends most of the document complaining about an 
individual called Mark, who he calls a “filthy Jew” while noting a donation of 0.1 bitcoin he, the attacker, 
received from this individual. The document asks, “why would a fucking jew give away money for free?”. 
This is a representation of the antisemitic stereotype that Jews are greedy, representing the second 
example of antisemitism provided in the IHRA definition. 


This stereotype originated in the Middle Ages when Jews were forced out of many occupations and 
often into money-lending which Christians were forbidden by the church from engaging in. This gave 
rise to the stereotype of Jews being greedy or obsessed with money.® This antisemitic trope is used 
again in the achievements list in the manifesto where one achievement is titled “2 Kikes 1 Shekel”, 
Shekel referring to the currency used in both ancient Israel and the modern state of Israel. The word 
association also seems to imply that 2 Jews would fight over 1 shekel, reinforcing the stereotype. 


This stereotype is contradicted by examples of Jewish philanthropy throughout the world. The Hebrew 
word Tzedakah means charity is a significant concept in Judaism. Research into Jewish giving in 


54 Steven K. Baum, Antisemitism Explained (University Press of America, 2012) 79. 

55115. 

56 Ibid 155. 

57 Geoffrey Hughes, Encyclopedia of Swearing: Social History of Oaths, Profanity, Foul Language, and Ethnic Slurs in 
the English Speaking World (New York: M. E. Sharpe, c2006). 

58 Ibid; This origin story is also related in the novel: Mordecai Richler, Solomon Gursky was Here (Random House, 
1991) 172. 

59 https://www.adl.org/media/13045/download 

© https://ncri.io/2018/09/06/a-quantitative-approach-to-understanding-online-antisemitism-part-2-temporal- 
analysis/ 

61 Derek Jonathan Penslar, Shylock's children: economics and Jewish identity in modern Europe (LA: University of 
California Press), p. 16. 

2 Rabbi Hayim Halevy Donin, To Be A Jew (New York: Basic Books, 1972). p. 48. 


24 


America highlighted how the average Jewish household donated USS2,526 per year to charity, 
significantly more than the average Protestant household at USS1,749 or the average Catholic 
household at US$1,142.® In addition to this is the charity from foundations. North American Jewish 
grant-making institutions contributed an estimated $9 billion to charity each year with about 75% of it 
going to non-Jewish causes.“ Then there are the mega-donors. The Forbes 400 in 2016 had at least 33 
Jews on it and only about 11% of their giving went to Jewish causes.°° 


In Australia a number of the leading philanthropists in the country are Jewish and can be seen in the 
“Australian Philanthropy Top 350” list. The list includes range of Jewish donors such as the Lowy 
Family, Besen Family, John Gandel and Pauline Gandel (Gandel Philanthropy), the Pratt Family (Pratt 
Foundation), Nora Goodridge (Goodridge Foundation), Smorgon Family, Hannah Cohen and family, 
Harry Triguboff, Bob Magid, David Gonski, Helen and Aron Kleinlehrer, and Penelope Seidler and the late 
Harry Seidler.®’ The list includes details of the recipients of the donations and while there are some 
Jewish causes lists, such as Jewish schools, most donations go to general causes in the fields such as 
higher education, the arts and medical research. 


5.2.4 Holocaust denial 

At the start of the attack in Halle the attack states in his video that the Holocaust “didn’t happen”. 
Denying the Holocaust is the fourth example of antisemitism listed in the Working Definition, specifically 
“Denying the fact, scope, mechanisms (e.g. gas chambers) or intentionality of the genocide of the Jewish 
people at the hands of National Socialist Germany and its supporters and accomplices during World War 
Il (the Holocaust).” 


Some prominent Holocaust deniers have tried to claim their denial is mere “scepticism” of the Holocaust 
and is not antisemitic, yet they have promoted deliberate ignorance and misrepresentation of 
overwhelming evidence.® Their efforts seek to portray Jews as liars and delegitimise the suffering og the 
Jewish people during and as a result of the Holocaust.® This latter point reveals another antisemitic 
aspect to Holocaust denial, which is that it either explicitly or implicitly suggest the existence of a Jewish 
conspiracy large and deceitful enough to fabricate an entire genocide. This relates to the second 
example of antisemitism in the Working Definition, being a “demonizing... allegation about Jews... or the 
power of Jews as collective”. 


63 Hanna Shaul Bar Nissim, “American Jews and charitable giving: An enduring tradition”, The Conversation, 11 
December 2017 https://theconversation.com/american-jews-and-charitable-giving-an-enduring-tradition-87993 
54 Ibid. 

55 Ibid. 

66 https://www.fundraisingresearch.com.au/top-donors.html 

57 Ibid. 

68 Richard J. Evans, Telling Lies About Hitler: The Holocaust, History and the David Irving Trial (Verso, 2002), p. 151. 
6° Walter Reich, “Erasing the Holocaust", The New York Times, July 11, 1993. 


25 


Holocaust denial was started by the Nazis themselves with organised 
disinformation campaigns even as the Holocaust was occurring.”° 
Towards the end of the war Himmler order the destruction of records, 
the crematoria and evidence of the mass murders.”* An order written in 
his own hand in April 1945, to prevent the spread of testimony, directs 
that no prisoner "fall into the hands of the enemies alive".’”? The denial 
continued after the Holocaust and occurred on both the political right 
and the political left. 


Holocaust denial was quick to manifest on the early internet, with 
many prominent Holocaust denying organisations turning to the 
internet in the mid-1990s to gain prominence and financial support.” 


This included the Institute for Historical Review (IHR) and the Figure 6 Order by Himmler 
Committee for the Open Debate on the Holocaust (CODOH), alongside stating that “Surrender is out of 
personal websites compiling the writings of individual prominent mhe questione No prisoner 


, , , , , ‘ shoud! fall into the hands of the 
deniers.” While this Holocaust denial movement declined in the early enemies alive”. 


2000s, its early rise on the internet means that its materials has had 
time to spread and can easily be distributed and recycled across the internet. 


In the manifesto’s achievements list there is an 
example of Holocaust denial and trivialisation. The 
achievement “Anudda Shoa” for killing 6 Jews is a 
reference to the well-known death toll of 
approximately 6 million Jews killed in the Holocaust. 
The death toll of the Holocaust is often mocked by 
antisemites online, using phrases like “Muh Six 
Gorillion”,”? sometimes accompanied by the 
antisemitic meme of the Jew. The achievement uses 
this theme, mockingly imitating a person saying 
“Another Shoah”, with “Shoah” being a Hebrew name 
for the Holocaust. 


ONE DOES HOTS IMPBY 


Figure 7 Example of the “Muh 6 Gorillion Holocaust 
denial alongside a merchant meme 


5.2.5 The ZOG Conspiracy Theory 

As discussed previously, the acronym “ZOG”, an abbreviation for “Zionist Occupied Government”, is a 
common antisemitic trope in the Halle attack. It falls within the Working Definition’s second example of 
conspiracy theories of “Jews controlling... government or other societal institutions”. Zionist here simply 
means Jewish, though some use Israel and Jewish interchangeably seeing Israel as the manifestation of 
the Jewish collective. Where the allegation is made that it is Israel controlling world governments, under 


7 https://encyclopedia.ushmm.org/content/en/article/combating-holocaust-denial-origins-of-holocaust-denial 

7 https://www.jewishvirtuallibrary.org/a-brief-history-of-holocaust-denial 

72 Mira Ryczke Kimmelman, Echoes from the Holocaust: A Memoir, Page 89 

73 Nicholas Terry, “Holocaust denial in the age of web 2.0: Negationist discourse since the Irving-Lipstadt trial”, in 
Paul Behrens, Olaf Jensen, Nicholas Terry, eds., Holocaust and Genocide Denial: A Contextual Perspective (London: 
Routledge, 2017), p. 38. 
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the Working Definition this could be seen as a form of antisemitic “targeting of the state of Israel, 
conceived as a Jewish collectivity”, and not a “criticism of Israel similar to that leveled against any other 
country”. 


The term was popularised by an article in The New York Times on 27 December 1984 which concerned 
robberies carried out by a white supremacist group called The Order. These robberies were carried out 
to fund a war against the United States Government, which the order called “ZOG” or “Zionist 


Occupation Government” .’© 


In the attacker’s achievements list ZOG appears again, this time when speaks about killing a “ZOG-bot”, 
a term that has been used in conspiracy circles since at least 2008 to refer to police.” It is based on the 
idea the police are robots who will act as ordered by the Jews who the conspiracy theorists allege are 
controlling the government and its institutions. Given that the term “ZOG-bot” does not refer to Jews, 
this example demonstrates how, in the words of the Working Definition, a “rhetorical manifestation... 
directed towards... non-Jewish individuals” can still be a manifestation of antisemitism. In this case the 
term, while directed towards non-Jews, also promotes an 
antisemitic allegation about Jews. 


The Classic on International Zionism 


In the post announcing the attack on meguca.org there is a line 
saying, “| would appreciate seeding, but only if your local ZOG 
won't van you for it.” The reference to “van” in reference to the 
“party van” 4chan slang for police.” The use of van as a verb is a 
reference to being picked up by police and arrested. The idea 
the police would be acting under orders that come from Jews 
who are pulling the strings of government is explicit. 


5.2.6 Redemptive Antisemitic Worldview 

The beliefs expressed by the attacker converge to represent 
what can be described as a “redemptive” antisemitic worldview. 
The term “redemptive antisemitism” was coined by historian 
Saul Friedlander to describe antisemitic worldviews that could 
explain everything in the world and offer some kind of 
“redemption” for antisemites.’? Redemptive antisemitic 
worldviews have existed in various forms throughout history, 
represented in the antisemitic text The Protocols of the Elders of 
Zion,® Nazi ideology, and the cultural Marxism conspiracy theory 


Figure 8 Modern example of the 
Protocols text. 


76 Brad Steiger, Sherry Steiger, Conspiracies and Secret Societies: The Complete Dossier (Mississippi: Visible Ink 
Press, 2013) p. 522. 
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that claims the Jewish intellectualism masterminded a conspiracy to infiltrate and bring down Western 
cultural and social institutions.** 


This worldview unites the various examples of antisemitism in the Halle attack. The Greedy Jew, 
Holocaust denial and ZOG conspiracy tropes converge into the idea of a worldwide Jewish conspiracy 
obsessed with gaining material wealth, through means such as falsifying the Holocaust, to fund their 
control over Western governments and their efforts to destroy the White race. This conspiracy theory, 
uniting all the Jews collectively into a target then provides a path to action and redemption for 
antisemites which the manifesto chillingly calls for when it say, “After all, if every White Man kills just 
one [Jew], we win.” 


The redemptive antisemitic worldview also connects the other forms of discrimination displayed in the 
manifesto and attack. The achievements list includes goals for attacking Muslims, communists, “traitors” 
Christians, “ZOG-bots” and burning down a Mosque. However, antisemitism is the uniting factor and 
most significant form of discrimination in this worldview, as indicated by the decision to attack a 
synagogue rather than a “mosque or an antifa ‘culture center’, which are way less defended”. 


In the worldview of the attacker, the Jews are responsible for all the ills in society, and even though he 
discriminates to these other targets, he portrays them as “golems”, referring to anthromorphic beings 
made from substances like clay in Jewish folklore.®? However, this term is also synonymous in both 
Judaism and beyond for a mindless entity.® In this way, he alleges that all these other targets of 
discrimination are mindless enemies directed by the “Zionist Occupied Government”, and that to 
redeem the world, antisemites must “cut of the head of ZOG, which are the kikes”. This uniting factor is 
a unique quality to antisemitism, and represents the second and third examples of antisemitism in the 
Working Definition. 


6 Responses to the Halle Attack 


6.1 /pol/ and the Image Boards 


6.1.1 Use of /pol/ to Spread the Manifesto and Video 
4Chan's /pol/ board soon started a discussion on the attack. While not shared at the start of thread, it 
wasn't long before copies of the manifesto were being shared. 
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Anonymous (ID: 
10/09/19(Wed)17:51:46 


Anonymous (ID: EEE 10/09/19(Wed)17-51-46 


At least post links. too. 

https: read-this-first- 
https: dokumentatio 
https: manifesuto-pd 


One posted responded suggesting 4Chan should be shutdown and 8chan restored, but without /pol/. 
The poster writes, "Hey FBI, these guys are uploading manifestos to the terrorist website known as 4 
chan. This site needs to be purged just like 8 chan and endchan were purged. Then maybe you could 

bring back 8 chan, just ban the /pol/ board." 


Anonymous (ID: 
10/09/19(Wed)18:20:08 


Anonymous (ID: (I) 10/09/19(Wed) 18:20:08 SI 


Hey FBI, these guys are uploading manifestos to the terrorist website known 
as 4 chan. This site needs to be purged just like 8 chan and endchan were 
purged. Then maybe you could bring back 8 chan, just ban the ‘pol’ board. 


The response from the poster who shared links to the manifesto documents was to draw a distinction 
between posting links that promote terrorist material and uploading a copy of the material. Such a 
distinction is of little consequence when it comes to making terrorist material available. It makes the 
mistake of trying to apply ideas learned from copyright law (where a link would not be a copy) to other 
fields where the crime will usefully be facilitating the spread of the material. 
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Anonymous (ID: 
10/09/19(Wed)18:22:08 


Anonymous (ID: QM) 10/09/19(Wed) 18-22-08 


>these guys are uploading manifestos to the terrorist website known as 4 chan 
No, you retard. I'm just *linking* them. They're uploaded at 


Jesus Christ. people, learn how the fucking internet works! 


Multiple copies of the manifesto were uploaded to multiple threads over the next 48 hours and beyond. 


Anonymous (D:33 9) 
10/10/19(Thu)10:11:27 No.229367905 

File: the face of a neet jpg (1.99 MB, 2448x3264) 
1.99 MB 

1.99 MB JPG 


Anonymous (ID: |) 10/10 19(Thu)10:11:27 


How did this guy manage to build his own weapons. but was dumb enough to 
get stopped by a wooden door? I think if anyone would plan on doing this for 
months they would at least ensure that they can get in. It must be a false flag. 


https: read-this-first-p 
https: dokumentation 
https: manifesuto-pdf. 


Links to the video were also shared, the most common being to bitchute.com but it was not the only 
source. 


The general sentiment on /pol/ was against Balliet, not because he was attempting a horrific crime, but 
because of what was seen as his ineptness at killing people. As one posted noted, however, "Tally 
another 2 for /pol/'s bodycount". While the first post was not on 4chan, and 8chan is currently down, 
these deaths are still a part of the /pol/ culture which has encouraged such violent extremism. 


Anonymous 1D: MJ Thu 10 Oct 2019 00:11:52 No B = 


Tally another 2 for /pol/'s bodycount 
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6.2 /Pol/ Fake News and Trolling 
On Wednesday night some on /pol/ on 4Chan decided to use the tragic events to spread fake news and 
troll an unrelated person. 


A threat with a link to a news article from the Washington Post was started with the added details that 
"Police report that a perpetrator of the attack on a synagogue in Halle has been arrested. The suspect is 
said to be Rainer W., known to the police, who had already been charged with incitement to hatred." 
The image used is of Rainer Winkler. 


ipot - Politically Incorrect thant? dox Nsw  Gimst Galimy 


TERRORIST IN GERMANY WAS FOUND Anonymous 1°: BE wes 09 oct 2019 [1631 95/ 103] 
UE vew Reply gnal Report 


Polce report hat a perpetrator of the attack on a synagogue in Haale has heen arrested The suspect is said to be 
Rainer W.. known to the police, who had alraady been charged with incitement to hatred 


hgs www v orwvvword/shooting-near. SyNaQGogue-ti-gennary saves al east wo-feape-deao 


poboa-say/201 1009/082 145 14-ea85-11e9-9306-47cb0324fdd4_ story html 


Anonymous 12: SEED Wed 09 Oct 2019 23:20:07 No SE GE eoor 


Typical nazi 


Winkler, who goes by the handle Drachenlord (Dragon Lord) is a German streamer, YouTuber and heavy 
metal fan. His YouTube Channel has over 11 million subscribers. He has been the subject of serious 
trolling. A female troll pretended to be interested in him, then when he proposed in a live stream, shot 
him down. He responded to the trolling and abuse by publishing his address and daring people to come 
try it in person. The result was the creation of a pilgrimage for trolls to visit him in groups. Some shouted 
abuse, some smashed windows, some threw eggs. In August 2018 a mass pilgrimage was called in which 
10,000 people said they would attend. Local police declared a multi-day ban on public assemblies. As 
many as 800 people, mostly adolescent, defied the ban. They came from as far away as Northern 
Germany, Austria and Switzerland. It took the reallocation of special security forces from a German 
football championship match to restore order. 


In this instance oe24TV started using the image of Winkler in coverage about the attack. This was quick 
shared via Twitter and victory was claimed in the same 4Chan thread. 
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Follow v 


Ahahahahaha 
#Halle @oe24tv @Oe24at 


View Same Googie iqdb SauceNAO Trace & 1506257047608 jpg, SKiB, 184x184 
Anonymous 1D: Thu 10 Oct 2019 03:40:04 No EY Report 


WE DID IT GUYS 
>WE DID iT 


https://twitter.com/Vivian_Veganer/status/1181958 105409708032 


https://twitter.com/Vivian_Veganer/status/1181956 105409708032 
https://twitter.com/Vivian_Veganer/status/1181958 105409708032 
This is not the first time /pol/ has tried to troll Winkler with fake news during a fatal attack. Hope Not 
Hate in the UK had reported how his images was also used during the Parkland shooting. 


6.3 Misidentification of Kohlchan 
The International Centre for the Study of Radicalisation at Kings College (UK) originally claimed that 
Balliet shared the documents through Kohlchan, a German equivalent to 4Chan. An update to the 
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articles notes that the Centre later amended that claim and correctly pointing to the meguca.org 
imageboard as the source. 


As of October 22, 2019 Kohlchan is still down with a notice stating that after analysis they have 
concluded this had nothing to do with them. They highlight how the incorrect information went viral 
through the mainstream media and also point to a news article which provides the correct information. 


= C @ kohichan.net 
We investigated the matter and concluded that the shooter did not use 
Kohlichan to spread his Twitch stream or his manifesto. 
The press releases of e.g. The Guardian, Sueddeutsche, ... contradict our 
findings and do not correspond to the truth. 


Update: 


shooter-meguca-anime-manifesto 


So either the "independent journalists” from Reuters, Deutsche Presse 
Agentur, The Guardian, Sueddeutsche, LeMonde, ... are exceptionally bad 
at their profession or they deliberately lied. 


Figure 9 KohIchan announcement 


6.4 Response from the Technology sector 

Concerns with the way social media platforms moderate user content has been a high profile issue since 
2008 when Facebook was challenged first challenged over antisemitism, and then specifically over 
Holocaust denial material.® After initial opposition, the complaints about Holocaust denial material 
eventually led to what is now the standard practice of geo-blocking content so that material prohibited 
by national laws in a country isn’t shown to users whose IP addresses indicate they are visiting from that 
country.® 


Traditionally technology platforms have responded to incidents on their platforms individually and with 
little cooperation. Terms of service vary widely when it comes to prohibiting hate speech. Randi 
Zuckerberg, then Facebook’s marketing director and spokesperson (and sister of founder Mark 
Zuckerberg) said it was “Facebook’s policy to not remove groups that deny the Holocaust” back in 


84 Andre Oboler, ‘Online Antisemitism 2.0. “Social Antisemitism on the Social Web”’, JCPA: Post-Holocaust and 
Antisemitism Series (April 2008, No. 67) <http://jcpa.org/article/online-antisemitism-2-0-social-antisemitism-on- 
the-social-web/> 

85 Andre Oboler, “Facebook, Holocaust Denial, and Anti-Semitism 2.0”, JCPA: Post-Holocaust and Anti-Semitism, 
August 2009 <http://jcpa.org/article/facebook-holocaust-denial-and-anti-semitism-2-0/> 
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2009,7 a position she has continued to promote in recent year, long after leaving Facebook.®® YouTube 
had taken a similar stand but reversed its policy in June 2019 saying it would now remove videos that 
deny “well-documented violent events” such as the Holocaust and school shootings.®? 


Under increasing pressure from governments to do more to tackle extremism, technology companies 
have begun working more closely together in tackling terrorism since 2017. This pressure has 
significantly increased since the Christchurch attack in March 2019 and under the Christchurch Call 
which governments and technology companies have signed up to support. Halle marked the first time a 
more formal and systematic collective response was put into action. Data from that collective effort 
identified 36 visually-distinct videos across multiple platforms.” This section examines the response to 
the Halle incident by a range of technology platforms. 


6.4.1 Twitch 

Twitch’s first public response to the Halle attack can be seen in series of tweets made at 1:30am Central 
European Time (CET) on October 9", around 13.5 hours after the attack started. A further update with 
some corrections was provided in a series of tweets on October 17". The times and dates in the images 
provided in this section reflect the local time in Melbourne, Australia, for each Tweet. 


The first tweet expressed the 


company's shock and condolences Q Twitch @ == 
for the victims. It was liked over wit 

12,442 timesiand retweeted over We are shocked and saddened by the 
1,579 times. 


tragedy that took place in Germany 
today, and our deepest condolences go 


out to all those affected. 


Figure 10 Twitch’s first tweet after the attack 


87 Michael Arrington, “Facebook Employees Speak Their Mind On Holocaust Denial”, TechCrunch, 16 June 2009, 
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89 Reuters, “YouTube Bans Holocaust Denial Videos in Policy Reversal", VOA, 7 June 2019 
https://www.voanews.com/silicon-valley-technology/youtube-bans-holocaust-denial-videos-policy-reversal 

°° https://gifct.org/press/gifct-statement-halle-shooting/ 


34 


The second tweet stated the company has a "zero-tolerance policy against hateful conduct, and any act 
of violence is taken extremely seriously".*! They state that they acted with urgency to remove the 
content and "will permanently suspend any accounts found to be posting or reposting content of this 
abhorrent act." That post received 4,594 likes and 398 retweets. 


A later tweet from October 17 (CET) indicates that it was not until 5:50 pm CET, almost 6 hours after 
the live streaming of the attack started, that the video was in fact removed and the associated channel 
suspended.” From the information provided in the fourth Tweet from October 9*,? it appears the delay 
in removal may have been a result of 
the video not being reported by © Twitch @ a 
other users until around the time it : 


was removed. 


Twitch has a zero-tolerance policy 


Without known exactly when the against hateful conduct, and any act of 
video was first reported to Twitch, violence is taken extremely seriously. We 
and therefore at what point they worked with urgency to remove this 
became official aware of the video content and will permanently suspend 
on their platform, it is impossible to any accounts found to be posting or 


know how quick their response was reposting content of this abhorrent act. 
and whether the claim that they 


“worked with urgency” is in fact 
accurate. 


RECOMMENDATION 11: When a 
violent extremist attack is Figure 11 Twitch's second tweet after the attack 

livestreamed the platform that was 

used to stream the incident and / or host the initial video of the incident should provide transparency on 
exactly when the livestream and/or video was first reported to them and when exactly they acted to 
remove it. 


RECOMMENDATION 12: Platforms should take all reasonable steps to facilitate and encourage the 
reporting of material depicting and promoting violent extremism, as well as all other reasonable steps to 
identify such material themselves. They should expeditiously remove such material once they become 
aware of it. Provided the above steps are taken, there should be a clear safe harbour protecting 
platforms from liability for material they are unaware they are hosting. 


91 https://twitter.com/Twitch/status/1182000480349605889 
2 https://twitter.com/Twitch/status/1185200174953455620 
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The third gave the initial information saat 
suggesting around 5 people viewed the Q a 
attack live and that the video lasted 35 
minutes,” as mentioned this was later 
revised to 3 people having watched it 


We're continuing to investigate the Halle 
event and would like to share what we've 
uncovered. The account owner streamed 
live.” this horrific act live on Twitch for 35 

minutes, during which time it was viewed 


The fourth tweet noted that a video was i ; 
by approximately five people. 


automatically saved from the livestream 
that in the 30 minutes before it was 
flagged and removed by Twitch staff 2200 J E e 
people had seen it.% Further details on 
this were provided on October 17" 
highlighting that in addition to the 2200 
who saw it in the half an hour before it 
was removed, a further 333 had seen the Twitch @ 
video prior to this.” © 


Figure 12 Twitch's third tweet after the attack 


. ; A recording of the stream, which was 
Twitch goes on to note that "This g = r z 


account was created about two months Twitch ® 
prior to streaming the shooting and had © car ES 
attempted to stream only once 
before."® Their investigation noted that ie 
the video was not appearing in any © edra 
recommendations or directories, 
meaning that the viewers were not a 
result of internal promotion on Twitch 
but rather of external sharing of the link 
outside Twitch. They state, "our 
investigation suggests that people were 
coordinating and sharing the video via Figure 14 Remainder of the October 9 tweets from Twitch 
other online messaging services." 


© Twitch © 


Twitch noted that they shared the harsh of the video with an "industry consortium" that works to 


prevent such content being spread. Later posts on the 18th of October named the consortium as GifCT. 


Twitch is not directly a GIFCT member, but its parent company Amazon is one of the members. 


%4 https://twitter.com/Twitch/status/1182036266344271873 
3 https://twitter.com/Twitch/status/1185200174953455620 
% https://twitter.com/Twitch/status/1182036268202381313 


97 https://twitter.com/Twitch/status/1185200176006230016 
38 https://twitter.com/Twitch/status/1182036269519368193 


9 https://twitter.com/Twitch/status/1182036270710571009 
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Twitch @ @Twitch - Oct 18 

Our intention and priority remains being transparent with our community and 
the wider industry so we can learn and develop best practices to improve online 
safety. With this in mind we've now concluded our investigation and would like 
to add to what we've shared previously 


Ọ 12 Tl 15 © 291 


Twitch @ @Twitch - Oct 18 v 
This attack occurred at 12:00 CET and was streamed live for 35 minutes, with just 
three live viewers. Twitch responded to a user report of the archived video and 
removed the content and suspended the channel at 17:50 CET, 


Ọ 7 1 10 Q 163 


Twitch @ @Twitch - Oct 18 v 
Users who viewed the video found it via links that were published on third party 
sites, with the vast majority (2200 of 2533 total viewers) accessing it in the 30 
minutes before it was taken down, 


ye | Q 225 


Twitch @ @Twitch - Oct 18 v 
We are always looking for ways to improve the safety of our community and are 
reviewing processes and tech to help limit the spread and visibility of this type of 
content. We will not be sharing details to avoid people manipulating the system 
or circumventing our controls. 
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Twitch @ @Twitch - Oct 18 v 
The effectiveness of industry collaboration has been proven through GIFCT and 
the quick action taken to share the hash and help prevent the spread of this 
content. More about this work here: 


GifCT 

The objective of the Global Intemet Forum to Counter 
Terrorism is to substantially disrupt terrorists’ ability to 
promote terrorism, disseminate violent extremist 


Figure 15 Twitch tweets from Octber 17 (CET) 


6.4.2 Telegram 

Copies of the video were distributed through the encrypted messenger app Telegram.?™ Prof. Megan 
Squire first reported the spread of the video to Telegram, noting that in public channels she monitored 
there were two primary sources, one for the long video and the other for a short version. +t These 
sources were in turn amplified by smaller public channels. 4 of the small channels only shared the long 
video while 5 shared both the long and short videos. She estimated the total audience was around 
15,625 accounts, though there may be some overlap with people being in more than one of these 
channels. 


100 hitps://heavy.com/news/2019/10/stephan-balliet/ 
101 hitps://twitter.com/MeganSquireO/status/1181980782417633280 
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& megan squire 


How the Halle shooter's media content flowed through 
Telegram in < 30 minutes. There are two source 
channels, one for a long video, another for a short clip 
Each video was amplified via "forwards" by smaller 
channels, shown in black. Total audience was ~ 15,625 
accounts. 


information flow on “Terrorgram” Telegram Channels 
Case: The Hale Shooter's livestream, 08-Oct-2019 


k 


& Channels amplifying video 


annoi (hong wietea) 


e 


y Ii 
4 Lf 
Source charwe! (snort video) © 


Figure 16 Prof. Megan Squire documents the spread to Telegram 


Much of the discussion around Telegram and terrorism previously focused on government calls to 
compromise encryption, it is important to stress that this use of Telegram was in public groups which 
both researchers and law enforcement could monitor without the need to compromise encryption. 


6.4.3. Google 

Preliminary work we carried out after the attack identified copies of the three manifesto documents on 
a range of internet sites as well as two links allowing access to view the attackers video. Some of the 
manifestos were found by monitoring /pol/ and other sites, but others were found through a Google 
search. We contacted our liaison at Google to discuss this and were urged to file an online report. 
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In completing the form we noted:?” 


the Christchurch Call and Google's Commitment to "Prioritising moderation of 
terrorist and violent extremist content, however identified". In light of this 
commitment, we urge Google to voluntarily remove links to this content rather than 
allowing this material advocating terrorism to remain online [until] formal 
government take down action occurs. We note this content related to a GIFCT 
Content Incident Protocol incident. 


Google responded to our online submission three days after we made it. The response highlighted that, 
“Google aggregates and organizes information published on the web; we don't control the content found 
in the pages you've specified”. They went on to note that “in accordance with Google's practices 
concerning content removal, the following URLs will be removed shortly from Google's search results for 
Australia”. This only covered the links to the video, not the other links to copies of the manifesto. Google 
rejected one link, a blog post that included links to PDFs uploaded as blog content. One link Google 
correctly reject as by the time they looked at it the content has been removed. The remaining links, 
including the links to the uploaded files at the blog, google requested further information on. 


While Australia’s Abhorrent Violent Material laws only require a hosting or content services to remove 
Abhorrent Violent Material, not links to that material, the Broadcasting Services Act 1992 (Cth) goes 
further and has provisions relating to “link services” such as search engines. 


Link services can be issued a take-down notice by the eSafety Commissioner to remove their links to 
prohibited content so long as the service has an “Australian connection”.'°° The act defined “Australian 
connection” for content services and in a note states that “a link is an example of content”, meaning link 
services are content services for the purpose of deciding is they have an Australian connection. A service 
has an Australian connection if “any of the content provided by the content service is hosted in 
Australia”.1° It’s been known since 2010 that some of Google’s content was being served from within 
Australia, '°° and since 2017 Google has also offered cloud serves hosting in Sydney.'°° Google is 
therefore has an Australian connection and can be subjected to take-down orders both for hosting 
prohibited content and for linking to it. 


Google’s distinction that they don’t host the content they link to does not reduce their liability when 
they host links that point to prohibited content. We tried explaining this to Google and noted that the 
terrorist manifestos they were linking to would have to be classed as prohibited content if they were 
referred to the Classification Board.’” In their response Google asked us to: 


102 Report to Google 25 October 2019 

103 Broadcasting Services Act 1992 (Cth) Sch 7 Pt 3 Div5 

104 Broadcasting Services Act 1992 (Cth) Sch 7 s 3. 

105 https://www.itnews.com.au/news/found-google-australias-secret-data-network-168772 

106 https://www.cio.com.au/article/620891/google-opens-sydney-cloud-region/ 

107 This is required under S 9A of the Classification (Publications, Films and Computer Games) Act 1995 (Cth) 
108 Response from Google 28 October 2019 
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Please copy and paste, or clearly identify, the exact text or content you claim violates 
applicable law. Also, please explain the specific reasons why you believe the text or 
content violates or is illegal under applicable law. It would be helpful if you could cite 
the specific law(s) of your country you believe to be applicable to the content in 
question. 


In our reply we highlighted that three of the links were to copies of the same document (the 
“DoKumentation” part of the manifesto) hosted in different places. We explained that the document 
contained “Terrorist instruction material on page 9” and cited a passage saying “Most grenades are filled 
with a simplified formula of [redacted] from the book [redacted] made as followed: [redacted]”. We 
gave the passage in full without the redactions. We then added “State objective of violence on page 9: 
‘3. Kill as many anti-Whites as possible, jews preferred’" and “Incitement for others to copy this stated 
violence on page 10: ‘The only way to win is to cut of the head of ZOG, which are the kikes. If | fail and 
die but kill a single jew, it was worth it. After all, if every White Man kills just one, we win." 


The response from Google also included some standard boiler plate which is perhaps not the best advice 


to be giving people in relation to content promoting terrorism:?” 


Even if we eliminated the page from our search results, it would still exist on the web. 
We encourage you to resolve any disputes directly with the owner of the website in 
question. Please visit https://support.google.com/websearch/answer/9109 to learn 
how to contact a site's webmaster and request a change. 


More than two weeks after providing the information most of the links to the manifesto still appear in 
Google search results. The blog post is still there, but the links to content on it no longer appear in 
Google. On further examination, the blog post itself now had three deadlinks. The documents that were 
uploaded to the blog show up with error messages. An examination of the hosting provider shows the 
blog was using Cloudflare’s Content Delivery network. Given the recent statement by Cloudflare’s 
CEO,7”° it appears likely it was action by Cloudflare to cease providing access to copies of these 
manifestos that has causes the files to vanish. 


Google seeks to draw a distinction between hosting content and search saying the Christchurch Call 
does not apply to its search services. That position will be seen by many as a step backwards and we 
would urge all parts of Google to fully commit to combating terrorism. There should be no exceptions. 


RECOMMENDATION 13: Google should commit to supporting the Christchurch Call across all parts of 
the business without exception. This includes preventing Google’s search engine being used to access 
material promoting terrorism. 


109 Ibid. 
110 Matthew Prince, “Terminating Service for 8Chan”, Cloudflare Blog, 5 August 2019 
https://blog.cloudflare.com/terminating-service-for-8chan/ 
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6.4.4 GIFCT's Responsive Action 

In July 2017 four of the largest technology companies, Facebook, Microsoft, Twitter and YouTube, 
decided to work together in their efforts to tackle terrorism.* The collective effort was called 

the Global Internet Forum to Counter Terrorism (GIFCT) and while others have been invited to join the 


project, membership is “limited to companies operating internet platforms and service”. 


During this incident GIFCT for the first time activated its new Content Incident Protocol (CIP). A timeline 
of the action taken has been published to provide transparency and to help further improve the 
protocol. 


The first communications between the GifCT founding members (Facebook, Microsoft, Twitter and 
YouTube) occurred at 5am Pacific Time which is 2pm in Germany. That's 2 hours after the incident 
started and around 1.5 hours after it stopped being live streamed. At this stage the communications 
were triggered because of eye witness accounts that the attacker was wearing video equipment and 
which made it likely there was a livestream, but the platform in use was unknown. 


Four and quarter hours later, more than 6 hours after the attack started, GifCT became aware of the 
video circulating on non-GifCT platforms. 54 minutes after this they formally declared it a Content 
Incident Protocol event and for the first time activated the agreed protocols. Those protocols involved: 


1. Alerting all members of the GIFCT that an active CIP was underway 


2. Uploading hashes of the attacker’s video, its derivatives, and other related 
content into the shared GIFCT hash database with a dedicated label to enable 
quick identification and ingestion by GIFCT member companies 


3. Alerting the German government and Europol that an active CIP was 
underway 


4. Continuing communications among GIFCT founding members to identify and 
address risks and needs during the active CIP 


5. Establishing the timing of a Situational Awareness Interval when GIFCT would 
be able to share some detail of the CIP with impacted governments 


The CIP event ended 22 hours later when the volume of attempts to upload the content to member 
platforms had significantly reduced. GifCT noted how in this instance only "36 visually-distinct videos" 
edits of the video emerged, far less than occurred with Christchurch.‘ In Christchurch there had been 


111 https://gifct.org/about/ 
112 Ibid. 


183 https://gifct.org/press/gifct-statement-halle-shooting/ 
114 https://gifct.org/press/gifct-statement-halle-shooting/ 
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more than 800 distinct edits of the attackers videos and Facebook alone had removed 1.5 million copies 
of it. 


The GIFCT response is commendable, but being the first time there is room for further improvement. It 
is unclear how long Twitch knew about the content before GIFCT was notified. The provision of a 24/7 
hotline for use by any technology company, whether or not they are member, and the promotion of this 
hotline within the sector may help to speed up responses in the future. 


It also appears only the video was being tackled by GIFCT when the manifesto documents also deserve 
attention. Finding these documents is in many ways easier than finding different variants of the video. 
GIFTCT should ensure manifesto material is included in its activities. 


As content is more rapidly removed there will be a growing need for researchers from government, 
academia and civil society to be able to access terrorist material for research purposes. GIFCT is well 
placed to maintain an archive of such content and to accept, perhaps as associate members, researchers 
who after vetting could have access to that archive. 


RECOMMENDATION 14: Through the Global Internet Forum to Counter Terrorism (GIFCT), technology 
companies should provide a contact mechanism that is staffed 24/7 and available to assist any platform 
whose technology is abused to share manifestos or live streaming. 


6.4.5 The Tech Sectors Response in General 

Tech Against Terrorism, a London based NGO, is an initiative launched by the United Nations Counter 
Terrorism Executive Directorate (UN CTED) in April 2017. They aim to support the global technology 
sector in responding to terrorism and have a particular focus on supporting smaller technology platform. 
Following the attack provided analysis on the technology sectors response. 


Tech Against Terrorism release an analysis on the tech sectors response on October 15", 2019.1 The 
response includes both helpful details and some information that has since been disproven. Greater 
cooperation between technology platforms and civil society is needed to ensure analysis in accurate. 
The analysis provides a snapshot of what was thought in the week after the attack. Two items of 
outdated information are that the initial message was posted on Kohlchan, it was actually Meguca.org, 
and the claim Twitch removed the content within 30 minutes, while an initial Tweet from Twitch give 
this impression, it actually took closer to 6 hours for removal but most of the activity viewing it occurred 
in the final 30 minutes before removal. 


In their briefing Tech Against Terrorism noted how many large and small platforms worked to prevent 
the spread of the content but state that the "response by smaller tech platforms and larger tech 
platforms to prevent virality are being undermined by both the mainstream media and fringe 
platforms." The also noted the use of both Twitter and Telegram 


In their analysis, openly available through their website, Tech Against Terrorism list a range of services 
where at the time of writing copies of the manifesto and videos could be accessed. While direct links to 
the content were avoided, naming the platforms still had the unfortunate effect of increasing the risk of 
the terrorist content spreading. We recommend civil society organisations circulate such details 


115 https://www.techagainstterrorism.org/2019/10/15/analysis-what-can-we-learn-from-the-online-response-to- 
the-halle-terrorist-attack/ 
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confidentially to key stakeholders and avoid naming platforms until the content is no longer available 
there. 


Tech Against Terrorist also mentioned the Terrorist Content Analytics Platform (TCAP) which they are 
developing with the support of Public Safety Canada to share data between platforms, academia, and 
data scientists. The system will also serve as an archive to help with the development of automated 
content classifiers. We welcome this development. 


RECOMMENDATION 15: Access to the Terrorist Content Analytics Platform should be available to 
researchers after they are vetted to ensure they represent legitimate research efforts in government, 
academia or civil society. 


RECOMMENDATION 16: The Terrorist Content Analytics Platform or a similar service should offer a tool 
for archiving and preserving online content for use by law enforcement and in legal proceedings. Adding 
content should be available to the public, but accessing archived content should be restricted to vetted 
people from government, academia and civil society. 


RECOMMENDATION 17: Civil society organisations should redact or avoid naming hosting services that 
are making terrorist content available, but should confidentially report such content to key stakeholders 
in government, industry and civil society. 


RECOMMENDATION 18: All companies that allow hosting of user generated content should have a 
process to receive reports from the public related to material promoting terrorism and this process 
should ensure rapid review. 


6.5 Government Action 

Germany has taken an international lead in tackling online hate speech over the last few years, and has 
proposed further law reform in response to the Halle attack. Australia has enacted world leading 
legislation to tackle the live streaming of abhorrent acts in response to the attack in Christchurch. In this 
section we examine how these countries responses to the online elements of the Halle attack. 


6.5.1 Germany 

Justice Minister Christine Lambrecht highlighted the connection between online incitement to hate and 
extremist violence saying, "What the disinhibition and unleashing of hatred in the net can lead to was 
shown again in the terrible attack on the Jewish community in Halle".1"¢ 

Germany passed strong laws back in June 2017 requiring platforms to remove hate speech within 24 
hours if its illegality was obvious and within 7 days when the determination was more difficult to 
make.!! Failure would leave companies facing fines of up to €50 million." While announcing the move 
in 2017 Justice Minister Heiko Maas said that "Death threats and insults, incitement to hate or 


116 Kate Brady, “Germany announces plans to combat far-right extremism and online hate speech”, DW, 30 
October 2019 https://www.dw.com/en/germany-announces-plans-to-combat-far-right-extremism-and-online- 
hate-speech/a-51049129 

117 AFP, “Germany imposes €50 million fines on social media firms that don't delete hate speech”, The Local DE, 30 
June 2017 https://www.thelocal.de/20170630/germany-imposes 

118 AFP, “Germany imposes €50 million fines on social media firms that don't delete hate speech”, The Local DE, 30 
June 2017 https://www.thelocal.de/20170630/germany-imposes 
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(Holocaust denial) are not part of freedom of expression -- rather, they are attacks against other 


people's freedom” and “intended to intimidate and mute others”.*”° 


Following the Halle attack the Germany Government announced they would go further, creating new 
laws requiring platforms such as Facebook, YouTube and Twitter to report incidents of hate speech and 
the IP address of those who post them to government authorities. A spokes person for Germany's 
Data Protection Commission said it was “too early to say whether this is good or bad" but that, “there 
will certainly be questions to be asked regarding the ethics of private companies deeming what counts 
as a conspicuous post on social media."224 


Companies make such judgements all the time when it comes to enforcing their own terms of service, 
the difference here is the involvement of the state and the possibility of a company’s action leading to 
criminal sanctions. If a store has CCTV and someone commits a crime against the store, for example 
stealing, the store would have no difficulty in reporting the matter to police and handing over the CCTV 
footage. Similarly, if a customer was assaulted by another customer while in the store, the company 
would have no difficulty handing over CCTV footage to police. On the other hand, a customer swearing 
at another customer, even if captured on CCTV and potentially subject to a fine for disorderly conduct, 
would be unlikely to be reported. The question is simply where the line is drawn. 


In Germany the line indicating hate speech is fairly clear given platforms are already under an obligation 
to identify and remove such content. The question is what level of hate speech should be reported. 
Rather than a blanket report of every incident, a move which would overwhelm state resources and 
essentially treat major and minor offenses the same, we recommend that “a combination of sanctions, 
training, and educative efforts should be put in place”.1?? As will all crime, the more serious incidents 
should be immediately reported to authorities. In the case of hate speech this involves threats of 
violence, incitement to hate and incitement to violence. In other cases, sanctions may start with 
penalties by a company, but once a company has exhausted its efforts at education and deterrence, the 
mater should escalate to one in which the power of the state intervenes. 


A number of doctrinal principles have been considered in arriving at this conclusion.?23 The principle of 
generality suggest it is better to have laws that apply in all circumstances and are not specific to the 
online context.’ The principle of inclusion suggests that it should not be possible to escape the law by 
acting online rather than in the real world.*2° The principle of appropriate adaptation says laws targeted 
at the Internet specifically are appropriate when there is an “impact on the nature of the conduct or its 


119 Ibid. 

120 Kate Brady, “Germany announces plans to combat far-right extremism and online hate speech”, DW, 30 
October 2019 https://www.dw.com/en/germany-announces-plans-to-combat-far-right-extremism-and-online- 
hate-speech/a-51049129 
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122 Pompeu Casanovas Romeu and Andre Oboler, “Behavioural Compliance and Law Enforcement in Online Hate 
Speech”. TERECOM 2018 Technologies for Regulatory Compliance: Proceedings of the 2nd Workshop on 
Technologies for Regulatory Compliance co-located with the 31st International Conference on Legal Knowledge and 
Information Systems (JURIX 2018). 125-134. 

123 Andre Oboler, “Legal Doctrines Applied to Online Hate Speech” (2014, July) Computers and Law 10 
http://www.austlii.edu.au/au/journals/ANZCompuLawJ|/2014/4. pdf 

124 Jonathan Clough, Principles of Cybercrime (Cambridge University Press, 2010) 15. 

125 Neal Kumar Katyal, ‘Criminal law in cyberspace’ (2001) 149 University of Pennsylvania Law Review 1003, 1005-7. 
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prevalence” as a result of harmful behaviour going online.*2 As a corollary to the principle of 
appropriate adaptation, the nature and prevalence of conduct online can at times make non-criminal 
responses in practice more effective than a criminal response.’’ The principle of necessary 
criminalisation holds that when responses short of the criminal law would be ‘ineffective, impractical or 
insufficient’, a criminal response is justified.” The conclusion then is that “the criminal law is needed as 
a final response to online hate speech”,’*? the end of an escalating series of responses. There is also a 
need for laws that enable technical solutions to overcome what would otherwise be technical barriers in 
applying the law. 


RECOMMENDATION 19: Serious hate speech, that which makes threats of violence or incites either 
violence or hatred, should be immediately reported to authorities. Other forms of hate speech should 
be removed by the platform, but a log of the incident including the users account and IP address should 
be recorded. Users should be informed when a platform takes action against them and should be 
warned repeated breaches could lead to a report being issued to authorities. Where platform sanctions 
prove ineffective at altering behaviour, the history of breaches and IP address of the user should be 
referred to authorities. 


RECOMMENDATION 20: Once a user has been referred to authorities, a summary of any further hate 
speech incidents involving that user should be notified to authorities periodically (e.g. monthly) by the 
referring platform. 


RECOMMENDATION 21: Once a user has been referred to authorities, the authorities should seek to 
convert the IP address into details of the accountholder and add it to the record. Where the account 
holder is a company, the company should be notified with a request to identify the specific user. 


RECOMMENDATION 22: Where a company cannot provide information on the person who committed a 
breach of the law against serious or repeated hate speech, assistance should be provided. Where a 
company will not provide information on the person who committed a breach of the law against serious 
or repeated hate speech, the company itself should be liable to corporate fines. 


RECOMMENDATION 23: Users referred to authorities by platforms for repeated breaches that do not 
involve incitement to hate or violence should initially be issued a warning, potentially after a discussion 
with authorities in which their actions are discussed. Further breaches should lead to escalating fines. If 
fines fail to provide a deterrent more serious measures including imprisonment should be available. 


RECOMMENDATION 24: Legal exemptions should be provided for researchers from government 
agencies and departments, academia and civil society engaged in testing the effectiveness of both 
platform and government agency responses. Such exemptions may require prior approval of the 
research by one or more authorised people or agencies who are independent of the enforcement 
system. 


126 Jonathan Clough, Principles of Cybercrime (Cambridge University Press, 2010) 16. 

127 Andre Oboler, “Legal Doctrines Applied to Online Hate Speech” (2014, July) Computers and Law 10 
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6.5.2 Australia 

In Australia the response for online safety and regulation of content such as that associated with the 
Halle attack rests with the Office of the eSafety Commissioner. This is a government agency created in 
2015, initially for the purpose of providing online safety for children.*°° The remit has been expanded a 
number of times since then and the current purpose of the office is “to help safeguard Australians at risk 
from online harms and to promote safer, more positive online experiences”.‘*! The overarching goal is 
preventing harm through awareness-raising, education and best practice guidance.**? The eSafety 
Commissioner has also been granted regulatory powers to prohibit material and order taken downs. 


The eSafety Commissioner also has the power to issue a notice which affects the enforcement of new 
laws on Abhorrent Violent Material.*? This is a category of prohibited content created in light of the 
Christchurch attack and includes sound, image and video, created by a person who is recording or 
livestreaming their conduct as they engage in a terrorist act, murder or other specified crimes.**4 The 
livestream and subsequent video of the Halle attack falls clearly within the definition of Abhorrent 
Violent Material and it is a criminal offence for content and hosting services to fail to expeditiously 
remove / cease hosting such content.! This law applies as along as the content can be accessed in 
Australia, regardless of whether it is actually hosted in Australia or not.!® Failure to comply can result in 
a penalty of the greater of 50,000 penalty units ($10.5 Million at present) or 10% of global profits for the 
month the failure occurred and the previous 11 months.’’ There is also the potential for jail time of up 
to 3 years or a fine of up to $2.1 million for individuals. ”° 


The Halle Attack began at 10 pm Australian Eastern Daylight Time. Early the next morning the Office of 
the eSafety Commissioner was in contact with Facebook, Twitter, Amazon and Google and worked with 
them to understand the situation in relation to the services offered to Internet users in Australia.1?° They 
also assessed a range of sites which were likely to be used to further distribute the material to gauge the 
risk of viral distribution.1 The eSafety Commissioner became aware of three items of Abhorrent Violent 
Material and issues notices against each of the content services and their relating hosting services, a 
total of 6 Abhorrent Violent Material notices, which resulted in several items being removed." In 


communications with OHPI the Office of the eSafety Commissioner expressed the view that the GIFCT 


appeared to work well to suppress the virality of the content”. 


|“ 


Content Incident Protoco 
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The eSafety Commissioner also has power to refer content to the Classification Board. The work of the 
Classification Board will be familiar to people in the form of film classifications such as G, PG, M or MA 
15+. The Classification Board has the power to classify Internet material, but in practice uses it very 
rarely. Where content that is to be classified relates to a terrorist act, there is a requirement that it be 
given the classification of “RC” (Refused Classification).“” In explaining the “RC” classification the 
Classification Board explains:1!46 


Material that is Refused Classification is commonly referred to as being ‘banned’. 
Films, computer games and publications that are classified RC cannot be sold, hired, 
advertised or legally imported in Australia. Material that is classified RC contains 
content that is very high in impact and falls outside generally accepted community 
standards. 


Material with an RC classification is also “prohibited content” under Schedule 7 of the Broadcasting 
Services Act 1992 (Cth).‘*” Australian residents, bodies corporate carrying on activities in Australia, and 
Commonwealth, State and Territory Governments, are able to make a complaint to the eSafety 
Commissioner about material that can be accessed in Australia which is prohibited content, or content 
that would be prohibited if it were classified." The eSafety Commissioner can carry out an investigation 
in response to a complaint, or on her own initiative.’ If the eSafety Commissioner carries out an 
investigation and prohibited content is found on a hosting service with an Australian connection, the 
eSafety Commissioner must issue a final take-down notice to have the content removed.*? 


While the classification and prohibited content approach overlaps with the Abhorrent Violent Material 
approach in the case of a video like that produced by the attackers in Christchurch or Halle, the two 
approach have some differences. The Abhorrent Violent Material approach creates a liability that occurs 
without the need for notice to be given, but it is far narrower as it only applied to material that records 
or livestreams the attack itself. The classification approach can also be used for video material which 
may be used to glorify the attack, but which was not created by the attacker or an associate of theirs 
and therefore fails the test for being Abhorrent Violent Material. The Abhorrent Violent Material 
provisions also only apply to online services, while the classification approach has broader reach and 
also prohibits the sale, hire, advertising or import of the material in other formats (for example, as data 
ona physical device). 


Perhaps most significantly, the classification approach can also apply to manifestos produced and 
published in advance of an attack, but which are clearly a part of the terrorist act. This can be seen in 


M43 Broadcasting Services Act 1992 (Cth) Schedule 7, S 22(1)(g) 
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147 Broadcasting Services Act 1992 (Cth) Schedule 7, S 20(1)(a) 

148 Broadcasting Services Act 1992 (Cth) Schedule 7, S 41 

14 Broadcasting Services Act 1992 (Cth) Schedule 7, S 37(1) 

150 Broadcasting Services Act 1992 (Cth) Schedule 7, S 44. 

451 Broadcasting Services Act 1992 (Cth) Schedule 7, S 47. 


47 


New Zealand’s response to the Christchurch attack where the Government quickly classified the terrorist 
manifesto as "objectionable material", their equivalent of RC, and the New Zealand Department of 
Internal Affairs explained that, "this means that it is also illegal to hold a copy, share / distribute it under 
NZ Law".1°3 


Australia took the same approach in response to Christchurch. The Annual Report of the Australian 
Classification Board for 2018-2019 shows that only two requests for classification were made in relation 
to Internet content, both at the request of the eSafety Commissioner, and both were given a RC 
classification.’ The first item refused classification (Classification Number: 283834) matches the 
terrorist manifesto from the Christchurch attack. It is described by the Classification Board in the annual 
report as:?°° 


...@ digital 87-page document, embedded within a PDF document... [which] described 
an ideological viewpoint, which was espoused to justify and encourage acts of 
terrorism against Muslim people. ...The Board was satisfied that the content 
promotes and incites in matters of crime or violence; and that it directly counsels, 
promotes, encourages and urges the doing of a terrorist act and directly praises the 
doing of a terrorist act in circumstances where there is substantial risk that such 
praise might have the effect of leading a person (regardless of his or her age or any 
mental impairment that the person might suffer) to engage in a terrorist act. 


The second item (Classification Number 283833) matches the description of the video of the 
Christchurch attack created as a result of the live streaming on Facebook. It is described in the annual 
report as:?°° 


..@ Short film — in the form of a recording of what appeared to be a live action video 
stream — that depicted the lead-up to and the shooting of a number of individuals 
inside a mosque and the events immediately following the shooting. ...The Board was 
satisfied that the content depicted, expressed or otherwise dealt with matters of 
crime, violence, cruelty and revolting or abhorrent phenomena in such a way that it 
offended against the standards of morality, decency and propriety generally accepted 
by reasonable adults; and that it directly counselled, promoted, encouraged and 
urged, and that it directly provided instruction on the doing of a terrorist attack, and 
directly praised the doing of a terrorist act in circumstances where there was a 
substantial risk that such praise might have the effect of leading a person (regardless 
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attack-publication-the-great-replacement-classified-objectionable 
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of his or her age or any mental impairment that the person might suffer) to engage in 
a terrorist act. 


This classification approach has an additional declaratory benefit. By having the material classified as RC, 
and therefore prohibited content in Australia, a signal is sent to content providers. Some companies 
who are not bound by a country’s laws will as a matter of their own corporate policies seek to prevent 
their services being used to share content that is illegal in a country to users in that country. If the 
declaration is not made, the company policies may not be triggered. Effective cooperation between 
government and industry requires content to be classified, even when the government lacks jurisdiction 
to take action. 


In the case of Halle communications with the Office of the eSafety Commissioner stated that the video 
was handled as Abhorrent Violent Material, but was not referred for classification as there were no 
reports of the content being hosted in Australia.” It was also noted that under the Abhorrent Violent 
Material laws notices to remove content could be issued, including to overseas sites, without seeking 
classification. 


The law related to prohibited content covers not just the content itself, but also links to it. If in the 
course of an investigation the eSafety Commissioner is satisfied that an “end-users in Australia can 
access content using a link provided by a links service” and “the content is potential prohibited content” 
(that is content which is likely to be classified RC if referred to the Classifications Board) and “the links 
service has an Australian connection”, then “the Commissioner must” issue an “interim link-deletion 
notice” and “apply to the Classification Board” for the content to be classified. As noted previously, 
Google appears to be a Link Service with an Australian Connection and also appears not to be removing 
links to the manifestos which are “potential prohibited content”. This suggests there may be a legal 
requirement for the content to be referred for classification and for Google to be directed to remove 
links to the content. 


There is an alternative interpretation which suggest an “Australian Connection” does not exist unless the 
primary hosting location of the content, and not just servers to help with redistribution, are in Australia. 
If the intent of Parliament is to cast as wide a net as possible the term “Australian Connection” could be 
more clearly defined both in general and specifically for link services. There is a strong public policy 
argument that services which profit from advertising targeted at Australians, and which alter their 
content based on the fact a user is in Australia, should be subject to Australian laws on prohibited 
content. Complying with Australian law is a reasonable requirement for platforms targeting their 
product at the Australian market and profiting from doing so. 


Based on a search of the classification board's RC decisions, since the Christchurch related classifications 
there have been no referrals of internet material to the Classifications Board. This mean the terrorist 
manifestos in Poway, El Paso and Halle have not as yet been refused classification in Australia. 


During the course of this research the website of the Classification Board was updated and the online 
tool for reviewing classifications no longer allows users to easily request a list of all classification in a 


157 Communications between OHPI and the Office of the eSafety Commissioner, 30 October 2019. 
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given date period by classification. This decreases government transparency. The classification of the 
Christchurch material was also obfuscated with the material listed as "ESAFETY CONTENT" 001 and 002. 
The manifesto was in fact listed as a film, not a document, in the record of the decision and made no 
reference to Christchurch. Neither did the video. There are ground not to provide, for example, the titles 
of Internet materials, but some reasonable description to aid those checking the record is needed if the 
Rule of Law is to be upheld. The public can’t be expected to avoid e.g. importing prohibited content if 
the declaration that it has been refused classification has been obfuscated. A descriptive title such 
"Christchurch attacker's manifesto" and "video of live stream of Christchurch attack" would give 
sufficient clarity. 


RECOMMENDATION 25: The eSafety Commissioner should refer all unclassified Abhorrent Violent 
Material for classification by the Classification Board. This should become a standard part of the process 
when new Abhorrent Violent Material is identified. 


RECOMMENDATION 26: The eSafety Commissioner should refer the manifesto documents from the 
terrorist attacks in Halle, Poway and El Paso to the Classification Board as was done in the case of 
Christchurch. 


RECOMMENDATION 27: The eSafety Commissioner should announce when terrorist related material 
that has a risk of going viral has been given an RC rating and should advice the public to report any 
online copies to the eSafety Commissioner and not to share it.*°? 


RECOMMENDATION 28: In Australia consideration should be given to creating a civil penalty regime for 
sharing material classified RC that promotes terrorism. Suitable exemptions should apply for those 
acting reasonably and in good faith for the purpose of journalism, scientific research or law 
enforcement. 


RECOMMENDATION 29: The Classification Board should restore the previous tool that allowed more 
detailed interrogation of Classification Board decisions, specifically, it should allow all decisions in a 
given period for a particular classification to be listed. 


RECOMMENDATION 30: The Classification Board should ensure either the title or a useful description is 
provided for material which is given an RC classification. This is necessary as the public can’t comply with 
a ban if the banned content cannot be identified. 


6.6 Civil Society Action: Online Hate Prevention Institute 

In addition to this in-depth report the Online Hate Prevention Institute completed a confidential report 
on November 24" which we shared with government and impacted technology companies. In that 
report we identified a range of sites hosting material related to the Halle attack. All of the material was 
accessible from Australia. It included a copy of the video, still available at this time, and multiple copies 
of the manifesto documents. It also highlighted how search results were aiding access to this material. 


After discussion with one of our contacts at Google we were ask to complete a removal request form. 
We did so and Google responded 3 days later. As discussed in the Google section, this resulted in the 
removal of links to two copies of the video and a request for further information in relation links to the 
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copies of the manifesto, which we provided. More than two weeks later we believe this ticket is still 
open and we have not heard back. 


We have also been in contact with the Office of the eSafety Commissioner and have urged them to refer 
the manifestos to the Classifications Board. Should the content be classified RC, which is the only 
possible outcome if it is referred, it will make it much easier for Google to remove the search results. 


This report, prior to be being released publicly, is being shared with many of the impacted technology 
companies as well as other experts and stakeholders. Our aim as an organisation is always to lend our 
unique expertise and be a critical stakeholder working with governments, industry and civil society to 
reduce the risk of harm from online hate and extremism. We thank all of those who have engaged with 
us in this process. 


7 ACulture Leading to Violent Extremism: The Image Boards and /pol/ 

Image boards are online discussion forums with a particular focus on the use of images. They are an 
early Internet technology and at the time added a significant new capability for Internet users, the 
ability to easily share and discuss images online. Another feature of these forums was the anonymity of 
their users. This was benefit to these forums given the illegal nature of much of the content that was 
being discussed and shared. The image board concept originated in Japan but spread around the world. 


In recent years there has been a shift in the image board culture as people set their sights beyond the 
online world. This has given rise to Anonymous first as a hacktivist group, then a larger political 
movement. It has also given rise to the Alt-Right, a social and political movement that seeks to alter the 
values of society and which stands in direct opposition to modern values of equality and human rights. 
Most worryingly, it has given rise to a sub-culture which incites and revels in violent extremism. It has 
created a global culture where hate and extremism can grow and fester. 


The section begins with an introduction to the Japanese origins of the image boards. We then move into 
a discussion of 4chan, 8chan and the culture of /pol/. 


7.1 Image Board Origins 

Ayashii World (Japanese: Ayashii Warudo - @*? LL‘ I — JL F, Literally: Strange World) is the 
predecessor of the image boards and the first to introduce the anonymous discussion board culture.*© It 
is also credited with introducing verbal memes, ascii art, and the first visual meme of online culture - the 
giko-neko ASCII art cat with a speech bubble whose message could be altered.**? 


Masayuki Shiba first operated Ayashii World in 1995 (between approximately August and December) 
through a dial-in Bulletin Board Service run by Nifty-Serve, then Japan’s largest internet service 


160 “Achan - A Timeline History of Chan Imageboards”, Know Your Meme, 20 May 2016, seen 2 November 2019 
<https://knowyourmeme.com/photos/1123439-4chan>; “A small history of Ayashii World”, 9 February 2013 seen 
2 November 2019 <http://ayashiiworldhistory.blogspot.com/2013/02/a-small-history-of-ayashii-world-1.html>; 
“Complete History of 4chan”, seen 2 November 2019 <http://tanasinn.info/wiki/Complete History of 4chan>; 
“2ch Chronicle”, seen 2 November 2019 <https://en.wikibooks.org/wiki/2ch_ Chronicle>. 

161 Ndee “Jkid” Okeh, “The Protochannel and the First Channel -- Ayashii World and Amezou World — The 
Grandparents of the Western Imageboard Culture”, Yotsuba Society, 21 March 2011 seen 2 November 2019 
<http://yotsubasociety.org/ayashii-and-amezou/>. 
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provider.*® It operated on the “home party” service which allowed only an ID, title, name, and a post 
with a length of up to 20 lines of text to be displayed.*© 


This first version of Ayashii World focused on the computer game Kasumigaseki (2s 7 fl). Released by 
an anonymous computer programmer in August 1995,1° the game was based on the Sarin gas terrorist 
attack on the Tokyo subway that March, an attack which killed 12 people and injured 5,000." Players 
completed for a high score in the game by selecting the locations to place 5 Sarin gas canisters with the 
aim of harming as many people as possible; 10 points were awarded per death and 1 point per injury.?© 


After closing for a time, then a brief revival as a “home party”, in August 1996 the board moved to the 
Internet using a free BBS service from a company called Digital Eden.*® In the BBS system the one 
internet provider both hosted the content and provided their paying customers with access to it, 
meaning there was no anonymity. In the new Internet based system the connectivity and the online 
service were separated. Further, identification became optional and “the contributors usually did not 
indicate their names in the name field, so that the community became an anonymous forum”.*® Ayashii 
World discussed images, including illegal content such as child exploitation material, but the service 
itself was technically incapable of hosting images and instead in their posts users would provide links to 
images which were hosted elsewhere.*©? Ayashii hosted a number of boards, among them gesu 
(Literally: “scum”), which was used to plan attacks against other sites in a similar manner to /b/ which 
later emerged on 4Chan.*” 


The first true image board, Licentious Notice Board (aka LNB), was created in August 1997.1” It allowed 
images to be displayed in posts. LNB was initially online at 
http://cgi.osk.3web.ne.jp/~fujinami/NoticeBoard.cgi,’”* and posts promoting it on other forums 
presented it as a place where anything, including illegal content, could be posted (as shown in Figure 17 
and Figure 19 which are translated in Figure 18 and Figure 20).*”? By 1998 a wide range of forums were 
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running the imageboard.cgi script and displaying images rather than linking to them became the 
norm.?”4 


<BR- is: © g ) 028214514} 


http://cgi.osk.3web.ne.jp/~fujinami/NoticeBoard.cgi 
TRO SERSRET YTS ARTY FMIRWAREZ 
BRRVTITSACEOK SA! 
http: //cgi-.osk.3web.ne.jp/~fujinami/NoticeBoard. cgi 


Figure 17 Original Japanese post promoting LNB on September 3, 1997 


<BR> Poster. © eun 09) Advertisement Posting Date: Wednesday, September 3 02:21:51 


http://cgi.osk. 3web. ne. jp/~fujanami/NoticeBoard.cgi 

Bulletin board advertised rant exposure underground information uncle corpse WAREZ 
Anything can be pasted! 

http: //cgi.osk.3web.ne.jp/~fujinami/NoticeBoard. cgi 


Figure 18 Google translate of a promotion post for LNB on September 3, 1997 


PBS: CRUG Coe) goH iat 


e. jp/~fujinami /Noticetioard. cgi 


Figure 19 Original Japanese post promoting LNB on September 11, 1997 


4 (FOR D ARRIR DROZ yR Ya Ay KOR PRAMS HFA” (2010) (Barubora, 
“Japan's Internet History Not Appearing in Textbooks”, (2010)) quoted and translated in “A small history of Ayashii 
World”, 9 February 2013 seen 2 November 2019 < 

>. 
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<BR> Poster Posting Date: Thursday, September 11, 07:50-14 


the bulletin board thet case out again I don't know who wrote it, but if you have 3 isəages, it's fun with erotic images ) 
ation, poop, cx 


itation-lNeron-Z eta-Collage-Erotic isege-Viruws-Anything is Ox! 


Figure 20 Google translate of a post promoting LNB on September 11, 1997 


Ayashii World closed on 3 September 1998 in response to ongoing antagonism and the users divided 
among a range of other boards.” Amezou, created by Amezou-shi to host a collection of links pointing 
to these other boards, soon developed in its own forum.?”° It also introduced the style of conversation 
threading known as “floating threads” which is still used in image boards today.?”’ In this style new 
threads appeared at the top of the list of topics, and within a thread new posts would appear at the 
bottom.?”8 Amezou also introduced threads being bumped up the list of threads when they received a reply, 
unless users “sage” them to prevent this. It is described as the First Channel."”° 


In 1999 trolls engaged in a significant campaign of vandalism against Amezou, 18° 


that cluttered the discussion threads making it unreadable.*®! Violent threats were also made against 
the owner,'® and there were rumours they originated with the Yakuza, the Japanese crime syndicate. 
Amezou-shi responded by closing the Amezou forum and calling on others to use his code and establish 
new image boards.1™ 


spamming it in a manner 


183 


Hiroyuki Nishimura, a user of Amezou and at the time a student at the University of Central Arkansas, 
responded to the challenge.®° On the 30 May 1999 using the code provided by Amezou he launch the 
image board Ni-Channeru (Literally: 2 Channel, or Channel 2) which drew in a significant part of the 
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former Amezou audience.“ It is named after the television station Channel 2 in the Kanto region of 
Japan, one of seven stations broadcast via VHF in the region, but is also a play on words as it was the 
second board for many after Amezou."®” 


2channel soon “became not only the largest Japanese-language anonymous forum; but the definition of 
the Japanese Internet” .188 One thing that set 2Channel apart is that despite still being a Japanese image 
board, it was hosted in the United States and was therefore beyond Japan’s stricter regulation of online 
content.’®? Post on 2channel included “racism and outright hatred toward society” through to criminal 
activity which ranges from leaked information on college entrance examinations to advertisements for 
murder.?%° Another use was to view “illegal or morally questionable violent content” given strict 
Japanese censorship of such content when it involves real people. 


A particular insight into 2channel can be seen in research into the forums response to the 27 October 
2004 beheading of Japanese national Shosei Koda in Iraq by al-Qaida. 2channel users shared images and 
video of the beheading, spread of fake news about the incident, promoted clickbait posts with link they 
falsely claiming led to the video, and trolled new users to 2channel looking for the material and who 
were tricked into revealing their IP address.*°* Empirical data over 5 threads and multiple days shown a 
high level of: anticipation of seeing the video, “banter” about Koda, neutral opinions and comments, 
information provision, and verification of information.!? At the end of monitoring period, once the 
video and news of Koda’s death was verified, there was a high degree of anxiety/ fear about the 
execution video, mourning over his death and discussions about terrorism, war and politics, as well as 
an extremely high level of traffic to download the video. Debate in the forum led to further discussion 
about the sharing of the execution video itself and moderation by the user community to limit or stop 
the spread of the video. The authors of the study noted how “postings expressing remorse and 
attempting moderation swelled in frequency and ultimately predominated” while anti-social postings 
decreased in face of the large number of posts promoting moderation.” The results show that even in 
an anonymous Internet forum, positive social norms can be established and have social impact but in 
the absence of that social pressure anti-social behaviour can dominate. 


By August 2001 traffic to 2channel had grown so large the site was struggling to cope.’ Two different 
approaches were taken, one by a sub-community of coders who sought to increase the efficiency of the 
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code which ultimately reduced the load associated with some scripts by 90%, and the other by those 
who sought to create a second image board to spread the load.” The original 2channel continued to 
operate, now alongside a new forum.1?8 


The new forum, also created by Hiroyuki Nishimura, was called Futaba channel (Literally: two leaves 
channel). It was established at 2chan.net and featured a graphic of a small plant with 2 leaves as its logo. 
For the first time in the channel boards, it also integrated the use of images.*°? It was Futaba which first 
created the board /b/ for posting random content.” 


These Japanese boards all contributed to the creation of both the technology and the online culture that 
exists today. The desire to engage in anonymous discussion free of the need for cultural or political 
correctness is part of the DNA of the original Japanese boards and remains part of the culture across 
image boards in all languages today. The Japanese online sub-culture moved into the English-speaking 
world and indeed became a global sub-culture with the creation of 4chan and a range of successor 
image boards. These boards developed their own culture while maintaining an appreciation for the 
Japanese online sub-culture from which they had grown. The use of anonymity on the image boards to 
allow not only politically incorrect speech, but to enable illegal activity and the sharing material related 
to violent extremism has continued and spread with the image boards themselves. 


7.2 The Rise of 4Chan 

There were English language forums in the United States, but most required registration and email 
verification, lacking the anonymity of the Japanese boards. 7° They also lacked the “floating threads” 
which had been so successful on the Japanese boards. The features of the Japanese image boards were 
brought to the English language Internet audience with the creation of 4chan in 2003. 


Founded by 15-year-old Christopher Poole in 2003, 4chan is an English language image board based on 
the code from the Japanese 2chan site. Its early growth was due to an exodus of users to 4chan from the 
forum ‘somethingawful.com’. Although originally intended for English-speaking fans of anime and other 
aspects of Japanese culture, 4chan’s scope rapidly expanded to encompass a wide range of topics. 


By 2010 4chan was the 800th most popular Internet site globally according to Alexa and attracted 
around 8.2 million unique visitors a month.” By October 2016 it had climbed to the 573 most popular 
site and was attracting 27 million unique monthly visitors.” Today the site 27.7 million users,?™ but has 
dropped to the 219,478 position in Alexa.”°° According to statistics presented for potential advertisers, 
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the site’s average audience predominantly male (about 70%) and in the age range of 18-34.” Australia 
makes up 5% of 4chan’s audience and is the 4" largest source of visitors to the site by country after the 
USA (47%), UK (8%) and Canada (6%).2°” Adjusted for population, of then 10 countries with the most 
visitors to 4chan Australian engagement (5.50%) is exceeded only by that of Sweden (5.54%) an 
significantly higher than the United States (3.98%). 


Achan provided the foundation for a great deal of popular culture which spread across the Internet and 
occasionally offline, while at the same time maintaining a “culture of abuse”. Among the positive 
contributions of 4chan to popular culture are the modern concept of a meme,?® LOLCats,”°? and the 
Anonymous movement.?? Negative contributions to online culture coming from 4Chan including 
encouraging suicides,’ coordinating extreme harassment,” and initially hosting the misogyny that led 
to Gamergate.?! 4chan has received sporadic bursts of high-profile media attention, usually for its 
negative impact. 


Achan has always cultivated a “too toxic to endure” culture steeped in sarcasm and irony that users 
claim is intentionally designed to confuse and shock new visitors. This culture was deployed as a tool for 
excluding certain social groups from participation and establishing subcultural boundaries and 
signposting group identity. One of the boards within 4chan, however, took this to a new level. The /pol/ 
board was regularly presented as a “containment zone”, a place within the 4chan community to 
quarantine behavior that was too toxic even for the rest of 4chan. 


7.3 /pol/ the “Politically Incorrect” Board and its Evolving Antisemitism 

The “politically incorrect” forum known for short as /pol/ can be found on 4chan, 8chan, and a range of 
other boards. The promotion of Nazism, racism, and xenophobia in general are popular themes on the 
board, and traditionally would continue only until someone started to take it seriously, before the mob 
would then turn on them. In recent years, however, that has changed. 


/pol/-users are responsible for a range of actions that gained widespread media attention. They turned 
Microsoft’s self-learning Twitter bot into a Hitler loving racist.’ They manipulated the media into 
believing there was a boycott of Star Wars on the grounds of the cast being too racially diverse and not 
‘white enough’.2?° They spent years trolling cartoonist Ben Garrison, turning his political cartoons into 
pro-Nazi and antisemitic propaganda, and were involved in the efforts to turn an antisemitic image into 
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a part of everyday Internet culture.2?° They are responsible for the spread of extremist slogans such as 
“Gas the kikes. Race war now” to a range of other platforms.7?” 


While it used to be hard to know what was serious and what was a result of /pol/lacks (users of /pol/) 
trolling each other, the extreme views which started as a parody became an earnest belief within the 
/pol/ community. This normalisation of neo-Nazism on /pol/ was in part the results of a campaign by 
neo-Nazis from Stormfront who sought to convert the /pol/acks to their ideology.” The rise of the alt- 
right also had a significant impact and /pol/ has become ground zero for a movement of “red-pilling”. 


The red-pill metaphor is a reference to a plot device featured in the 1999 film, The Matrix.?* In the film 
the rebel leader Morpheus offers the main character, Neo, the choice of taking a red pill which will 
break him out of the artificial reality in which he is living and allow him to see the world as it is. Neo is 
also offered the choice of taking the blue pill, which will allow him to continue living in the false but 
comfortable reality that has been constructed for him. The term Is frequently used across alt-right 
platforms as a means of distinguishing between a perceived informed minority (the red-pilled), and an 
ignorant majority (the blue-pilled). Rolling Stone Magazine explains how Andrew Oneschuk, who shot his 
two roommates at close range, had been convinced “through an intricate online world, that everything 
they’d ever learned was, essentially, a lie”.?? Starting on /pol/ but spreading through the Alt-Right more 
generally, the idea of being red-pilled or “woke”? is to reject the messages and values taught by 
society. The views that replace this are based on conspiracy theories, racism, misogyny and the 
promotion of white supremacy. 


Antisemitism has always been present on 4chan and was a part of /pol/ since /pol/’s inception in 2011 
[see Figure 5].22? Afterall, what could be more politically incorrect than claiming to support Nazism? This 
initial promotion of antisemitism was an attempt to cause shock and use the anonymity of the online 
forum to defy the norms of offline society. There was no particular malice towards Jews, instead the 
focus was on jokes and pranks expressed ironically to troll others. 
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Figure 21: The unofficial board logo/symbol for /pol/ underscores the recurring theme of Nazism on /pol/ boards. 


An example of how Holocaust denial was originally promoted as a joke on 4chan was the “Dub the Dew” 
raid in 2012 where 4chan users manipulated an online poll used to name the new Mountain Dew 
drink.2?3 Users were encouraged to “get all the Hitler and gushing granny names into the top 20”, 
resulting in the name “Hitler did nothing wrong” being voted to the #1 spot, with a variety of vulgar but 
not antisemitic names making up the rest of the top ten. The juxtaposition of a Holocaust denial name 
with other vulgar, but not antisemitic names indicates the top name was chosen to maximise the 
controversy of the incident, rather than to actually promote the idea of Holocaust denial. 


Over time /pol/ has been taken over by neo-Nazis and its culture has changed from one that was 
ironically racist, with antisemitism being a part of that, to one where violence against Jews is not just 
advocated, but live streamed for the /pol/ community’s entertainment. 


7.3.1 Antisemitic Alterations to Ben Garrison Cartoons 

Another source of antisemitic material on /pol/ took the form of pro-Nazi and antisemitic cartoons 
created by as a result of users altering libertarian cartoons created by cartoonist Ben Garrison. Where 
the original cartoons aimed at targets like big government, the banks and drug companies, the altered 
versions shifted the target to Jews. Garrison has been described as the Internet’s most trolled 
cartoonist,” and was once described by the Alt-Right’s Milo Yiannopoulos as “probably the most trolled 


man in internet history” .22° 


The trolling of Ben Garrison started in 2011 and coincided with the decline of /b/’s position of cultural 
centrality on 4chan, and the creation of /pol/. Fake Ben Garrison cartoons were a part of the culture 
that emerged on /pol/ right from the start. Whenever a new cartoon was released by Garrison, 4chan- 
users would race each other to see who could alter the cartoon into something antisemitic. The 
collective investment in these endeavours by 4chan-users, as manifest in the countless threads 
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dedicated to the cause, tapped into a kind of cultural crucible. On 4chan, only the most memorable 
productions will endure over time, because all ‘inferior’ productions are almost immediately displaced 
and deleted in the wake of the exceptionally fast pace in which content is posted and subsequently 
deleted on 4chan (cite). Consequently, whatever antisemitic material was produced first had to 
successfully endure this subcultural trial by fire, and would typically resonate with a wide audience, and 
could then be spread to multiple online forums and image hosting sites. The spread of the altered 
cartoons produced on 4chan was so extensive that they displaced the originals in online searches for 
Ben Garrison cartoons.?”° 


The March of Tyranny 
Original Defaced 


Figure 22 Original Ben Garrison cartoon [left] alongside a defaced version using the Antisemitic Meme of the Jew [right]. 


Garrison himself was also targeted, mostly by users on /pol/.?2” His image was photoshopped into a Nazi 
uniform and paired with fake biographical details. He was given the nickname “Zyklon Ben”, after the 
Zyklon B gas used to murder Jews at Auschwitz,” along a range of other names that sought to promote 
him as a hardcore Nazi. The “Zyklon Ben” name itself goes back as early as August 17 2011.77? A page 
dedicated to this entirely fictional Ben Garrison was created at Encyclopedia Dramatica in April 2013.7°° 
Despite the significant harm they caused him many on /pol/ genuinely liked the original versions of his 
cartoons and regularly said so. Acomment posted to Garrison’s blog in November 2016 says “/pol/ here, 
we miss having you around, Ben... It is all in good fun that the edits are made... This may seem odd, but 
for the most part /pol/ has great respect for you. You produce great cartoons with ideas that challenge 
the establishment. Don’t be bothered by the edits, ‘Imitation is the sincerest form of flattery’ right? And 
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come back and visit us again! Ave Zyklon Ben!”23! The comment appears sincere, but also demonstrates 
a complete inability to understand why a person might object to being associated with Nazism. This can 
be seen in the idea altered copies of Ben’s work, with his name on it, which promote Nazism are seen as 
nothing more than fun. It can also been in the sign off, “Ave Zyklon Ben”, both respectful and entirely 
blind to harm of the “Zyklon Ben” invention on the real Ben Garrison. 


Contemporaneous evidence shows the editing started at dchon sometime between May and August 
2011.72 Encyclopedia Dramatica claims the first edits occurred on the 4chon.net's Nazi board “/n/”.233 
This information tallies with comments OHPI observed after releasing a report which covered Ben 
Garrison cartoons in 2014.24 Garrison became aware of the altered cartoons and responded in May 
2011 with a blog post in which stating that someone was editing his cartoons by “adding in offensive 
Jewish stereotypes” while leaving his name on the images.”2° He reassured any readers of his blog that 
his “target” was the “elite international banking system and the Federal Reserve. NOT Jews.”2°° Garrison 
himself later stated that his wife found the source of the altered cartoons on 4Chan’s /b/.??” While /b/ 
was not the first to alter a Garrison cartoon, it was a source of the continued trolling, partly in response 
to his blog post. 


Further information on the trolling of Ben Garrison can be seen in OHPI 2014 report,”? and has also 
been covered in subsequent briefings.7?" 


7.3.2 The Antisemitism Meme of the Jew 
One common theme of antisemitism is what we call the 
“Antisemitic Meme of the Jew” which /pol/ refers to as “The 


Figure 23 Antisemitic Meme of the Jew 
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Happy Merchant” meme (see Figure 23).*“° It is a cartoon stereotype of a Jewish man with a black beard, 
long hooked nose, hunched back, crooked teeth and hands being wrung in glee. Our report into this 
meme covers its racist origins, including its creation by a white supremacist cartoonist and its use online 
in neo-Nazi circles, as well as its popularisation by 4chan and an attempt to integrate it into mainstream 
online culture through the Know Your Meme website.”*? New investigative research has revealed the 
author to be Nick Bogus and has shown that the cartoon has been circulating online since at least 
2001.74 


The meme is known for featured in antisemitic comics strips and being edited for a range of different 
contexts online. A recent report by the Network Contagion Research Institute covers how /pol/ creates 
large quantities of merchant memes and disseminates them into other social media spaces.7“7 


The image was integrated into the first edited Ben Garrison cartoon, and many subsequent ones. It has 
also infected other popular memes. Recent research “demonstrates numerous instances of the Happy 
Merchant infecting well-known and popular memes” with the authors noting how this infection “could 
serve, for instance, to make antisemitism more accessible and common”.2“* Importantly this is not 
qualitative research, but a quantitative examination of the problem. An example of popular memes that 
have been infected with the antisemitic meme of the Jew and their spread through Twitter can be seen 
in Figure 24. 


Through memes, and this one in particular in its many flavours, antisemitism is spread even by those 
who initially have very little antisemitic intent and see it as simply part of the online sub-culture. Over 
time, however, this exposure creates a normalisation and social acceptability of antisemitism which is 
known as the antisemitism 2.0 effect.” 
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Figure 24 Penetration of the Antisemitic Meme of the Jew features into other meme templates2*° 


7.3.3 A shift in /pol/’s antisemitism 

There has been interested in /pol/ by neo-Nazis on Stormfront since at least July 2012.7*’ At that time 
the “almost completely unmoderated” nature of /pol/ was already noted as a plus for spreading neo- 
Nazi ideology.”“* At this time there was push back on /pol/ to overt neo-Nazism.”“° 


By January 2014, however, a long time stormfront user described /pol/ users as “strongly pro-WN 
[White Nationalism], pro-NS [National Socialism] or pro-libertarian” adding that “the whole culture of 
the board is ragingly anti-jew”,”°° and that “there's a strong, almost overwhelming WN [White 
Nationalist] current on the /pol/ board”.?° 
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Some long-time users of both 4chan and Stormfront at this time felt “4chan members don't genuinely 
believe in NS [National Socialism], separatism, or any WN [White Nationalism] ideology... most... Simply 
fancy the idea of acting ‘evil’ and ‘racist’”.7°? Others drew a distinction between /pol/ and 4chan more 
generally. One said 4chan was “a cesspool of corruption” (from a neo-Nazi perspective), but said “pol/ 
on the other hand, has many people on there that are racially aware” but that it wasn’t contributing to 
the neo-Nazi cause beyond leading people to Stormfront.?°? Other’s highlighted the difference between 
/b/ and /pol/ saying the former was “teenagers being racist for shock value” while the latter was 
“everything from promoting traditional values... to exposing Jews”.°* Another explained that “/pol/ has 
only recently become a European Nationalist site” that it was “expanding at an unprecedented rate in 
influencing other sites on the internet”.2°° Another explained the influence of /pol/ explaining that, 
“/pol/ has made the notion of ridiculing Holocaust acceptable on the Internet with all the Ben 'Zyklon B' 
Garrison stuff and the like being funny as hell. You can now take more conservative stances without 
being bashed unreasonably, as well.”2°° 


The infiltration by neo-Nazis from Stormfront did not go unnoticed. By February 2013 others on 4chan 
were already complaining about /pol/acks invading other boards and posting antisemitic and racist 
content that was completely off topic and simply disrupted other conversations. The post is about /pol/ 
but says refers to those from /pol/ not as /pol/acks, but as Stormniggers and Stormfags,*°” derogatory 
terms for Stormfront users. 
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Figure 25 A 2013 post against /pol/ reposted in 2019 


There were always Holocaust jokes, but as a result of the infiltration of neo-Nazis, Holocaust denial has 
become so regular on /pol/ a quick inspection immediately led to a post promoting a Holocaust denial 
documentary (see Figure 26). The post is titled “New Holocaust Documentary by Ryan Dawson” and 
provides a link to view the documentary. It is accompanied by a version of the Antisemitic Meme of the 
Jew. 
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Figure 26 The Antisemitic Meme of the Jew used in a post promoting a 2019 Holocaust denial documentary on /pol/ 


The infiltration led to a significant cultural change between /pol/ and the traditional form of more casual 
antisemitism on 4chan. As a user on 4char’s QA recently explained (see Figure 27), on /b/ when people 
complained about antisemitic jokes they receive abuse or more jokes, on /pol/ the response is instead 
“text walls about how the Holocaust didn’t happen”. The poster explains, it “stops being humor when 
you put more effort into defending it than the people opposing it”. 


Anonymous 10/27/19(Sun)18:45:21 No aa > Saas 


it Stops m humor when you put more effort into defending it than the people opposing it 
/b/ would tell people to fuck off if they complained about a joke about jews or make a second, better joke, 
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Figure 27 A QA poster on /pol/ going beyond humour 


Even on QA, which usually sees very little infiltration from /pol/, a supporter of /pol/ quickly responded 
to this post by entered into a flame war and then a post saying their life would be “infinitely better when 
we can start killing you kikes in the streets”. Comments like this directed at violence demonstrate the 
toxic culture which as emerged within /pol/ and signal a significant shift from the antisemitism of earlier 
years. 
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Figure 28 A QA response from a /pol/ supporter 


There have been some threads on /pol/ seeking to push back against the takeover by neo-Nazis, but 
they have been largely unsuccessful. A thread in April 2018 asked “/pol/, can we kick out all the 
stormniggers and unironic racists? It's getting a bit too autistic here” (Figure 29).7°* The poster later 
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explained, “There's a difference between ironic racism and screeching "OY VEY GAS THE KIKES 1488" 
about everything” (see Figure 30).7°° Another user agreed saying it is felt a little too serious now, a third 
added “you realize that there is probably a reason it seems serious right?” .?® Other responses accuse 
the poster of being a Jew, various posts share antisemitic and pro-Nazi material. An Australian poster 
ridiculed the idea of changing the culture on /pol/ and the original poster replied, quite unironically, 
“Stormfront thought they could, and they pulled it off” (see Figure 32). Part of the shift to greater 
extremism, however, is demonstrated in this thread by an image post which simply depicts a Jew 
(represented by the Antisemitic Meme of the Jew) being killed execution style (see Figure 31). 
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Figure 29 /pol/ April 2018 asking to get rid of the neo-Nazis 
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Figure 30 /pol/ post highlighting concern 
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Figure 31 /pol/ post executing a Jew 
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Figure 32 Stormfront changed the culture of /pol/ 


In another thread calling for the neo-Nazi’s to be kicked off /pol/ in November 2018 (see Figure 33), the 
poster starts their message with a caricature of a post by a neo-Nazi.” Another user picks up one line in 
the impersonation that says “hurr durr I'm going to go out and shoot a bunch of kikes and niggers” and 
dismisses it saying “name one time this has happened” (see Figure 34). Since this post was made there 
have been 4 such incidents as documented in this report. 2019 has marked a significant shift in the 
nature of /pol/ and therefore in the way it needs to be treated. 
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Figure 33 Call to kick neo-Nazis off /pol/ in November 2018 
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name one time this has happened 


Figure 34 Dismissal of the idea of real violence 


7.4 Gamergate and the Rise of 8chan 

‘Gamergate’ is a catchall for a series of events that consisted mainly of the harassment of female video- 
game journalists, but also represents a watershed moment in a large-scale online cultural revanchist 
campaign against political correctness, identity politics and various other so-called ‘liberal agendas’ .?° 


Gamergate represented a critical juncture that contributed significantly to the unification and 


262 (Nagle 2017; Massanari 2017; Lyons 20174; Flisfender 2018) 


68 


galvanisation of previously disparate social groups that would eventually unite under the banner of the 
‘alt-right’, 7°? as discussed in the next section of this report. 


Gamergate began in 2014 with the harassment of Zoe Quinn, a video game developer, after her ex- 
boyfriend wrote a blog post that, once amplified by Adam Baldwin’s commentary on the matter via his 
considerable Twitter following, attracted mainstream public attention. It was claimed that Quinn had 
cheated on her boyfriend in order to advance her career in the videogame industry.2™ This precipitated 
a series of attacks on Quinn, including ‘doxing’, the dissemination of personal information online for 
malicious purposes (e.g., Quinn’s home address, phone number, office address and phone number etc.), 
along with the theft of compromising photographs, the fabrication of compromising photographs, and 
countless death and rape threats.” This pattern of behaviour, more or less enhanced, was replicated 
and levelled against numerous prominent female figures in the videogame industry.2& Accompanying 
the slew of increasingly severe harassment campaigns was a conspiratorial and enduring dialogue about 
‘journalistic ethics’ that seriously considered the possibility of organised, systemic and endemic female 
manipulation of game reviewers.7° 


Initially 4chan was used as a key staging ground to launch many of these abusive, hateful endeavours 
that were carried out and clearly attributed by name to ‘Gamergate’. The violent misogynistic 
harassment campaigns of gamergate eventually attracted so much attention from mainstream media 
and federal law-enforcement agencies that 4chan’s administrators banned even mentioning Gamergate 
(doing so is still grounds for a permanent ban from 4chan).2® This resulted in the migration of 4chan- 
users to the then relatively new splinter-chan known as 8chan.?° 


8chan was created by Fredrick Brennan in October 2013,” in response to an increase in moderator 
activity on 4chan to crackdown on illegal content. It closely mirrors (and in many ways outright copies) 
Achan, but is an independent site under different management and promotes itself as a “free-speech- 
friendly 4chan alternative”.?”1 Faced with censorship on 4chan, those involved in Gamergate shifted on 
mass to 8chan where the misogynistic conspiracy theories were there spearheaded and endured 
prominently long after the 4chan ban. In fact, the banning of discussion of Gamergate on 4chan, fed 
8chan’s exhortations of liberal censorship.” The fracture between the chans established some measure 
of animosity between the platforms, but this was somewhat bridged by the subcultural continuity 
provided by /pol/ as a dominant and consistent voice across the platforms. With its roots in the 
conspiracy, bigotry and hate of Gamergate, 8chan grew both larger and increasingly insular and hostile. 
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Unable to cover the costs to keep it running, Brennan sold 8chan to US military veteran Jim Watkins in 
October 2014,77? but continued to run the site until he quit in 2016. °” 


8chan became a dedicated forum for misogyny and discussions of perceived widespread misandry, but 
also expanded beyond the gendered politics of Gamergate to focus on violent extremism directed at a 
host of targets guided by the socio-political agendas of /pol/’s subculture that dominates the site. The 
culture in turn was able to become more extreme due to 8chan’s more extreme position on free 
speech.*” From its creation until the time it was closed on 16 September 2019, the /pol/ board on 
8chan hosted a total of 13,575,873 posts and would usually have between 2,500 and 3,000 unique 
visitors during a 72 hour period.””° 


8chan is now widely known for hosting a far more radicalized iteration of /pol/-culture that has 
attracted considerable notoriety for its connections to various violent crimes and terrorism, including 
playing a large role in the Christchurch shootings and subsequent attacks in Poway and El Paso. By early 
2019 Brennan had cut all ties with 8chan and after the mass shooting he went on a media blitz calling 
for the site he founded to be shutdown.””” 


7.5 Harnessing the Culture for Real Politics: The Rise of the Alt-Right 

The culture of what became known as the Alt-Right in part grew out of the online culture in places like 
Achan and 8chan, and in particular out of /pol/. This was not a grassroots political movement that 
emerged from the online culture, but rather a deliberate effort by political actors seeking to start a new 
movement to coopt the online culture, methods and community infrastructure to feed their growth. 


The Alt-Right offered to take the political fantasies of some and trolling of others within the /pol/ 
subculture, and related right-wing online cultures on platforms like reddit, straight into real world 
politics. There is an overlap between the Alt-Right and these online sub-cultures, but the Alt-Right also 
including overt white nationalist and neo-Nazis who are not necessarily connected to this online 
subculture. While using online platforms as a source of material and recruitment, the Alt-Right doesn’t 
support the sub-cultural ethos of anonymity, instead seeking to take their views mainstream so they can 
be spoken about openly.?” They shifting their activities to personal accounts on mainstream platforms, 
and when they were kicked off those platforms, onto a collection of alternative platforms such as Gab 
and Voat.?”? Unlike the chans, the Alt-Right has leaders with public profiles and often a thirst for media 
attention. 
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7.5.1 Political origins 

The term Alt-Right, or Alternative Right, is a term coined in 2008 in the title of a keynote address for the 
inaugural meeting of the H.L. Mencken Club.2®° The Club was created as a forum for an “intellectual 
right” which felt it was being “quarantined” by more traditional conservatives.”®! The leadership of the 
club included serval notable academic racists.7®* Paleoconservative political philosopher Paul Gottfried 
was the founder of the club, white supremacist Richard Bertrand Spencer the master of ceremonies for 
the inaugural meeting and anti-immigration activist Peter Brimelow delivered the keynote address.7°3 
Spencer and Gottfried have been variously credited with coining the term “Alt-Right” at this meeting. 


In 2010 Spencer founded the National Policy Institute and its online magazine “Alternative Right” with 
Paul Gottfried and Peter Brimelow as senior contributing editors.7*4 His stated aim was “to forge a new 
intellectual right-wing that is independent and outside the ‘conservative’ establishment”.2® This saw a 
generational shift not only in leadership but also in audience. 


7.5.2 Harnessing the Online Subculture 

The Alternative Right’s supporters were, according to Spencer, those who recognized the “uselessness 
of mainstream conservatism”, and were comprised of a younger demographic, often recent college 
graduates.” The Alternative Right continued to be linked to white supremacism,*” but the audience 
now came from online sources, mainly online forums like 4chan and similar communities on Reddit and 
Twitter.2°8 The /pol/ community was naturally aligned to the Alt-Right and the Alt-Right presented itself 
as the red-pilled true reality. 


The Alt-Right, as it has been manifesting online, is a combination of the traditional far-right, those just in 
it “for the lulz” looking for amusement, those disillusioned with mainstream politics and those seeking 
to capitalize on their grasp of online culture. From the neo-Nazi elements, conspiracy theories of Jewish 
media control and media dishonestly are a staple of the Alt-Right and efforts targeting the media and 
particularly Jewish journalists led to a significant rise in antisemitism during the US election campaign.”°° 


While seeking to undermine the mainstream media, the Alt-Right have also been creating “parallel 


media institutions”, promoting alternative news.??! 
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7.5.3 Campaigning for Trump 

/pol/ and the Alt-Right got behind Donald Trump in the 2016 election. A key symbol of this support 
became the use of Pepe the Frog. The Pepe cartoon character was created by Matt Furie in 2004 and 
became an exceptionally popular basis for a vast array of 4chan-memes, and eventually became a 
popular symbol used by prominent figures in the emergent ‘alt-right’ movement. By 2016, Pepe the Frog 
had acquired considerable notoriety. 


The use of Pepe the Frog by /pol/, however, came first and while it had a multitude of subcultural 
meanings attached to it, some of them were blatantly antisemitic. Examples of Pepe dressed as a Nazi 
can be found as early as 2014 (see Figure 35).”°* Nazi-related Pepe images also spread to platforms such 
as Twitter,2°? and Tumblr (Figure 36). 


Figure 35 This Pepe in a Nazi uniform can be seen as early as 2014 


292 Uploaded to https://knowyourmeme.com/photos/816541-feels-bad-man-sad-frog 23 August 2014 
233 Pepe in Nazi uniform on Twitter, July 12 2015 https://twitter.com/Xx Senpai_xX/status/620088820948598784 
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super rare skinhead pepe 


Figure 36 Skinhead Pepe on Tumblr in April 2015 


The association between Trump and Pepe was started on /pol/ by a Malaysian called artist called 
Maldraw on July 22, 2015.7 The original image featured Pepe with Trump hair at the US Border with 
Mexico (see Figure 37). Nazi Pepe, however, continued to be a regular feature on /pol/ around 
September and early October 2015 as seen in Figure 38, Figure 39 and Figure 40. 
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DONT MIND ME 
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Figure 37 First appearance of Trump as Pepe 
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Figure 38 Pepe on /pol/ 3 September 2015 
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Figure 39 Pepe on /pol/ 5 October 2015 
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Figure 40 Pepe on /pol/ 5 October 2015 
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On the 13* of October 2015, Donald Trump re-tweeted a rendering of himself as Pepe the Frog along 
with the caption, “you can’t stump the trump” (Figure 41). This tweet created an indelible link between 
Trump and the emerging alt-right.2%° Some scholars have suggested that Trump may not have 
understood the meaning or implications of his tweet, symbolically or otherwise.?”” Regardless, from the 
perspective of many 4chan-users, Trump’s appropriation of Pepe signalled the gravity of 4chan’s cultural 
significance. 


ey Donald J. Trump © £- Follow 


"@codyave: @drudgereport @BreitbartNews 
@Writeintrump "You Can't Stump the Trump" 
youtube.com/watch?v=MKH6PA... " 


s17 nos RRA RERZHO 


Figure 41 Candidate Trump retweeting an image of Pepe as President Trump 


Although plausible that Trump was unaware of Pepe’s symbolic significance, the same cannot be said for 
others, who rapidly identified the meme as well as its associations with /pol/ and the alt-right. 
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Hillary Clinton attempted to made use of Trump’s ties to Pepe and on the 12* of September 2016 


published a full-page explainer on Pepe the Frog on her Campaign website (see Figure 42). Tweeted only 
days after Clinton posted a Pepe the Frog explainer on her Campaign website, the visibility of celebrities 


like Cher tweeting about the symbolic associations between Pepe and Nazism, as well as the alt-right 
(Figure 43), shows how this knowledge had entered mainstream awareness. 


Donald Trump, Pepe the frog, and white 
supremacists: an explainer 


That cartoon frog is more sinister than you might realize. 


Why is there a frog standing directly behind Trump? 


That’s Pepe. He's a symbol associated with white supremacy 


Wait. Really? White supremacy? 


That's right 


Please explain. 


Here's the short version: Pepe is a cartoon frog who began his internet life as an innocent meme 


enjoyed by teenagers and pop stars alike 


But in recent months, Pepe’s been almost entirely co-opted by the white supremacists who call 
themselves the ”alt-right." They've decided to take back Pepe by adding swastikas and other 
symbols of anti-semitism and white supremacy 


Figure 42 Clinton’s pepe explainer from her website. 
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Figure 43 Cher tweeting on 16 September 2016 regarding the association between Pepe and neo-Nazism 
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The public response to Pepe was said to have “...delighted [4chan] denizens, who saw it as an example 
of ‘meme magic’ and a symbol of their significance” (Marwick & Lewis 2017, p. 22). It also increased 
Trump’s interest in generating political capital by trolling mainstream politics. Trump implicitly 
endorsing politically incorrect trolling by using Pepe imagery as part of his more explicitly politically 
incorrect social media comments. This became part of a larger tactical effort creating a “spreadable 
spectacle” in which polarising views, popularist rhetoric and extreme opinion were spread through the 
use of disinformation, appropriation of online culture and the mainstream media’s willingness to 
perpetuate partisanship.” /pol/ were ecstatic at Trump’s eventual election win.” 


Since the election, some close to both the Trump team and Spencer, like Charles C. Johnson, openly 
admit both to trolling and promoting conspiracy theories as a means of garnering votes. Milo 
Yiannopoulos, technology editor for Breitbart News and a key protagonist in the cyber-harassment 
campaign targeting women in the video game industry (Gamergate), as well as an anti-Islam 
campaigner, was another key figure in the Alt-Right.3°t The far-right website The Daily Stormer had a site 
banner which said it was the “The World's Most Visited Alt-Right Website” .3°? Andrew Anglin who run 
the site represents the neo-Nazi element in the Alt-Right and a link to the /pol/ base. He rejected a claim 
in the Washington Post that the Alt-Right’s “goal is often offensiveness for the sake of offensiveness in 
the way that many young white men embrace” responding, “No it isn’t. The goal is to ethnically cleanse 
White nations of non-Whites and establish an authoritarian government. Many people also believe that 
the Jews should be exterminated” 2° 


7.5.4 Implosion 

The Alt-Right was rapidly gaining stream until a National Policy Institute conference at the Ronald 
Reagan building in November 2016, just days after the election.>% At the event, after media were asked 
to leave, Spencer was caught on film raising his arm and proclaiming, “Hail Trump, hail our people, hail 
victory!” as several attendees responded with Nazi salutes.2°° This open Nazism was the start of split in 
the Alt-Right,2°° and the emergency of what became known as the “New Right”,°” or as Richard Spencer 
and the Alt-Right call them, the “Alt-Lite”.2°° These are people who had been part of the Alt Right but 
rejected the overt association with white nationalism and neo-Nazism. As Lucian Wintrich explained, the 
term alt-right had been “adopted by libertarians, anti-globalists, classical conservatives, and pretty much 
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everyone else who was sick of what had become of establishment conservatism” but when “Richard 
Spencer came along, throwing up Nazi salutes and claiming that he was the leader of the alt-right, he 


effectively made the term toxic” which caused others to “abandoned using it in droves” 2° 


The split became more evident in June 2017 with competing rallies in Washington DC. The “Freedom of 
Speech Rally” had been planned at the Lincoln Memorial, but after the Richard Spencer was announced 
as a surprise speaker, two other speakers, Jack Posobiec and Laura Loomer, pulled out and refused to 
share a platform with him.**° Posobiec instead organised the “Rally Against Political Violence” to occur 
at the same time in front of the White House.*"! The Alt-Lite, like the Alt-Right, embraces misogyny and 
xenophobia while opposing “the left” and “political correctness”??? Where the Alt-Right promotes the 
supremacy of White Nationalism, the Alt-Lite, according to Gavin McInnes, promotes “civic nationalism” 


and the superiority of “Western values”.313 


The real implosion for the Alt-Right came with the Unite the Right rally in Charlottesville, Virginia, on the 
11—12 of August 2017. The rally was organised by groups which included The Daily Stormer and the 
National Policy Institute.’ The rally was intended to mark the shift of the Alt-Right from an online 
movement to political force in the national spotlight.24° Hundreds of far-right activists attended along 
with a large counter protest.” Heather Heyer, a counter-demonstrator, was killed when a 22 year old a 
self-professed neo-Nazi drove his car into the crowd in what a judge described as “an act of terror” .3”” 
Hayer’s murder and the evidence of racism, hate and violence shocked America and led to a strong 
response with far-right protestors being identified, shunned by their families and in some cases fired 
from their jobs.?!8 There was also a crackdown by social media companies making further organising 
more difficult.74° The movement largely imploded.?2° 
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While there remains an overlap between people who would identify as Alt-Right or as neo-Nazis and 
some members of /pol/, the overlap is only partial. The Alt-Right took on a life of its own and shifted to 
other forums such as a Gab, and while it struggles in the United States, evidence suggests it is growing in 
Europe.??! The toxic culture on /pol/, meanwhile, is less coherent ideologically and more willing to 
encourage and celebrate violence for its own sake. The targeting of Christians in Halle in particular is 
inconsistent with the US style Alt-Right ideology. In /pol/ we see a culture in which the value of life is 
reduced and there is a presumption of a social acceptability to cause death for its own sake. 


7.6 Terrorism on 8chan’s /pol/ 

In 2019 /pol/ on 8chan was used three times to announce terrorist attacks and share the attacker’s 
manifestos. In two of the attacks, links to livestreams on Facebook invited the /pol/ community to 
become an audience to the attack in real time. The attacks all had elements indicating a submergence in 
/pol/’s subculture. This raises questions about the responsibility of 8chan and /pol/ and whether the 
evidence of repeated serious harm is enough to justify action both in the United States and in other 
countries to prevent further harm. In this section the three attacks prior to Halle are discussed, but it 
should be remembered that the Halle attack also has references back to /pol/ on 8chan. 
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7.6.1 Christchurch 

On March 15* 2019, a terrorist attack in 
Christchurch, New Zealand, led to the 
death of 51 people. They were shot by a 
lone gunman who targeted two mosques 
during Friday prayers. The gunman, 
Brenton Harrison Tarrant, was an 
Australian citizen living in New Zealand. 


The attack started with a post to /pol/ on 
8chan (see Figure 44).?” The post linked to 
a Facebook profile and said the poster 
would be live streaming an attack “against 
the invaders”. It said good bye in case he 
didn’t make it. 


Given the high level of anonymity that 
usually exists, that combination of a link to 
a social media account, a threat of attack 
and a goodbye, should have triggered 
alarm bells for many, and should certainly 
have done so for any law enforcement 
officer who might have been monitoring 
the forums. However, since it was posted 
immediately before the attack, even if it 
were observed and action had been taken 
immediately, the exceptionally short 
notice limits the options afforded to any 
quick response counter-terrorism strategy. 


The post provided links to a number of 
articles by Tarrant including his manifesto 
explaining his political motivations and 
seeking to answer any questions in case he 
didn’t survive. The attack, envisaged as a 
possible suicide attack, was designed to 


[1 *ahem* 
Anonymous 
03/15/19 
(Fri) 02:28:41 
ID: c800e3 


No.12916717 >>12916719 >>12916726 >>12916730 >>12916748 
>>12916763 >>12916770 >>12916773 >>12916784 >>12916807 >>12916835 
>>12916870 >>12916924 >>12916954 >>12916981 >>12917041 >>12917103 
2212917173 2212917219 >>12917236 >>12917279 2>12917280 2212917286 
>>12917290 >>12917301 >>12917330 
2212917444 


>»12917650 [Watch Thread] [Show All Posts] 


Well lads, it's time to stop shitposting and time to make a 
real life effort post. 

| will carry out and attack against the invaders, and will 
even live stream the attack via facebook. 

The facebook link is below, by the time you read this | 
should be going live. 

https:// www .face book . com/brenton.tarrant.9 

It's been a long ride and despite all your rampant faggotry, 
fecklessness and degeneracy, you are all top blokes and 
the best bunch of cobbers a man could ask for. 

| have provided links to my my writings below, please do 
your part by spreading my message, making memes and 
shitposting as you usually do. 

If | don't survive the attack, goodbye, godbless and |! will 
see you all in Valhalla! 
https://www.mediafire.com/file/3vejr5llI3r6xte/The_Great 
_Replacement.docx/file 
https://www.mediafire.com/file/u1 53u4aqviafb3y/The_Gr 
eat_Replacement.pdf/file 

https://mega.nz/#!e0tQ2Y4K 
https://mega.nz/#!C80myAZB 
https://www.solidfiles.com/v/4ad3yeXYn4Prz 
https://www.solidfiles.com/v/AngzB845g2gBM 
https://www111.zippyshare.com/v/dSteSOcu/file.html 
https://www111.zippyshare.com/v/gvXiTInN/file.html 


Figure 44 Post on 8chan’s /pol/ announcing the Christchurch 
attacks. 


make him a martyr. He wanted his words to spread and become part of the cannon of far-right literature 
available online; The sort of literature that he himself had read, and the kind of material he had 
consumed on 8chan that had contributed to his radicalization. 


A “board volunteer” for /pol/ (one of 5 moderators of the /pol/ board) removed the attackers post 2 
hours and 49 minutes after it went up according to evidence given to Congress based on the server 


322 https://ohpi.org.au/new-zealand-terrorist-attack/ 


80 


logs.??3 Little happened to 8chan after this first attack, despite the use of the platform to announce the 
attack and clear evidence of a connection to the online sub-culture, such as the reference to “stop 
shitposting” and “make a real life effort post”, in the message. The attack led to a significant 
international response including the creation of the Christchurch Call. 


7.6.2 Poway 

A little over a month after the mass casualties of Christchurch, on the 27" of April 2019, John Timothy 
Earnest entered a Synagogue in Poway California armed with an AR-15 type semi-automatic rifle, and 
opened fire. 74 Earnest followed the same pattern of behavior seen in Christchurch. Earnest posted an 
announcement to 8chan’s /pol/ when his attack was imminent, along with links to a livestream on 
Facebook, an ‘open letter’ (manifesto) that he posted to two different sites, as well as a playlist Earnest 
thought featured “awesome tunes” that he appears to have intended to play during the attack over 
livestream [see Figure 24]. 


<The Schan Global Rule> 
{ The Gentieperson's Guide to Forum Spies | Global Volunteers | Dost Test | FAQ} 


werything Keep up the infograptic tedpil throats Ivè or 


D Anonymous 04/27/19 (Sat) 20:04 34 ID: T4N7¢> No 13102006 


based 
get the high score 


> Anonymous 04/27/10 (Sat) 20:05 51 10 2hiwed No 13192030 


Figure 45 The Original Post (OP) made to 8chan immediately prior to the Poway shooting. 


He shot and killed one woman and wounded the attending Rabbi, another man, and an 8-year-old girl. 
The assault was cut-short when Earnest’s weapon jammed after firing less than the 10-round capacity of 
one Smith & Wesson MP15 magazine, prompting a hasty retreat from the scene. Earnest was arrested 
soon after without incident, with police retrieving a combat utility vest outfitted with 5 spare fully 
loaded magazines. Clearly, Earnest had intended to carry out a much more deadly attack, considering he 
was armed with around 60 rounds in total. Earnest had also chosen the last day of Passover for his 
attack, indicating a conscious decision to find a time to attack when a larger than usual number of Jews 
were likely to be in attendance at the synagogue. 


323 Congressional Supplemental Inquiries of 8chan, Submission to the Committee on Homeland Security, 25 


September 2019, Page 3 https://d5e10168-1d62-4e43-8269- 
5d58035f234e.filesusr.com/ugd/62f5a3_72d0c2b98ca3433c82baec24e08625e9.pdf?index=true 


324 https://ohpi.org.au/san-diego-synagogue-attack/ 


81 


This foreshadows the logic behind the Halle attack, which was carried out on Yom Kippur, but this is only 
one of several linkages between the attacks, 8chan and /pol/. The reaction to the original post featured 
in the two reply-posts visible in Figure 45 includes several subcultural references attributable to the 
*chans and /pol/. “Based” is slang used on 4chan and 8chan to refer to things that are, put simply, 
‘good’, but the term also has additional connotations, and is usually reserved as a means of ascribing 
(roughly) attributes of excellence to individuals. “Get the high score” is a cultural trope popular on 
platforms, including but not limited to the chans, that has found renewed significance and popularity on 
/pol/ and 8chan. 


This phrase harks back to the niche interests (i.e., ‘high scores’ in video games) inscribed in the board 
cultures of the platforms from which /pol/ originates, and it is commonly used by /pol/-users to express 
affirmation or encouragement to achieve something to a high standard. Since chan culture has shifted 
away from sarcastic/ironic deployments of hate speech, and particularly given the context of 8chan, the 
use of the phrase here should be interpreted to mean ‘kill as many Jews as possible’. Additional 
references to videogames are scattered throughout the playlist in the original post, which includes 
music from the soundtracks of popular titles such as Halo: Combat Evolved and The Last of Us. The 
juxtaposition of videogame terminology and exhortations to commit mass murder is not accidental and 
reflects an increasingly entrenched devaluation of human life on /pol/ (i.e. a real murder is treated the 
same as a kill in a video game). 


Much the same as with Christchurch, the Poway attack’s original post features many more distinctive 
subcultural markers that are readily traced to the idiosyncrasies of *chan and /pol/’s subcultures, with 
even more distributed throughout the post. The use of “greentext” in a reply-post as well as references 
to “meme magic” and “redpill threads” all clearly point to the attacker’s connection to /pol/’s 
subcultural productions. Indeed, the scepticism of other 8chan-users as exemplified in the reply-post 
“literal spam” reflects the additional problem presented by the ambiguity of fully-anonymous online 
spaces which have developed subcultural norms and expectations that promote a combination of 
suspicion, cynicism and scepticism. 


A “board volunteer” for /pol/ (one of 5 moderators of the /pol/ board) removed the attackers post 12 
minutes after it went up according to evidence given to Congress based on the server logs.?7°A tweet at 
the time had claimed it was removed in under 10 minutes.2”° This is a fast removal, but even so it 
allowed enough time for images of the post, along with the links it provided to the manifesto, to spread. 
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8chan (8ch.net) @ @infinitechan - Apr 28 v 
The Poway shooter's post on 8chan was taken down NINE minutes after creation. 
There are only screencaps available and no archives exist since the post was 


deleted so quickly, The loudest groups publicizing this crime and giving attention 
to this CRIMINAL are the fake-news media. 


© 201 tl22x O«ax B 


Figure 46 8chan removal of Poway attackers post 


The links in the post pointed to copies of the manifesto in PDF form at MediaFire and in text only form 
at Pastebin. The Online Hate Prevention Institute verified those links were still working around 20 hours 
after the attack and contacted the companies to request they remove the content. Mediafire took swift 
action and had already removed the file 4hours later when we first re-checked the link. Within 24 hours 
of our report being made they had followed up with us via e-mail to report on the actions they had 
taken. Pastebin was slower to respond and that copy remained live for around 50 hours after the attack. 
Pastebin did not meet its own goal of responding to complaints within 24 hours and took a few hours 
more than this to take action on our report. The delay allows the content to be viewed by far more 
people as shown in Figure 47. 


Reads on Paste Bin 53,118 63,500 75,950 


Figure 47 Reads on Pastebin of Poway attacker's manifesto 


At the time we stated that that countries such as Australia may need to consider blocking access to 
8chan so long as it continues to “provide a forum for such radicalisation that leads to violence” .3? We 
also said that: 


Blocking sites should be an absolute last resort, but sites running technology designed 
to make the job of police impossible, and with a track record of inciting and being 
part of deadly violent extremist attacks, cross that threshold. The effort to incite 
further attacks from people on /pol/, as stated in the manifesto, makes this a case of 
a clear and present danger. 


8Chan may consider suspending /pol/ in order to avoid such government responses. 
Another option would be far greater cooperation with police, not just in the US, but 
internationally. That would require changes to the software to enable a far greater 
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and longer term retention of data. Even so, greater moderation action against the 
hate that leads to extremism may well be needed. 


7.6.3 El Paso, the closure of 8Chan and the Congressional Inquiry 

On the 3 of August 2019, Patrick Crusius shot and killed 22 people and wounded 26 others outside a 
Walmart in El Paso Texas. Following what has now become the Standard Operating Procedure (SOP) for 
violent online extremism borne out of 8chan and /pol/, he posted his manifesto to 8chan’s /pol/ prior to 
commencing his assault.? The location of the attack was chosen because of its proximity to Mexico and 
high numbers of Mexican tourists known to cross the border nearby, and despite being an 11 hour drive 
from Dallas where Crusius lived. 


A “board volunteer” for /pol/ (one of 5 moderators of the /pol/ board) removed the attackers post 45 
minutes after it went up according to evidence given to Congress based on the server logs.?2° 


In the wake of the violence and public outrage (as well as a lawsuit brought against Watkins, Brennen 
and Matthew Prince, the CEO of CloudFlare), 8chan was pressured into shutting down*”°, and was driven 
off the surface web and ultimately offline when hosting providers and services such as Cloudflare ceased 
providing services to 8chan.?34 Watkins was also subpoenaed by the United States House Committee on 
Homeland Security on the 5‘ of September,?*? where he agreed to keep 8chan offline until “tools were 


developed to counter illegal content” .?73 
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<The Schan Global Rufe> 
[ The Gentleperson’s Guide to Forum Spies | Giobal Volunteers | Dost Test | FAQ | 


File (eter 7te5860S7 C373 — odf 28.93 KBP Cunt, detter at) (>) 
H> ITS TIME Anonymous carat © Ousus - Motficaben Leteo 356104 corm eosa [Walch Thed] [Enau Thread [Show Al Posts! 


Fuck this is going to be so shit but | cant wait any longer Do your part and spread fis brothers! Of course, only spread t i the aflack is successiu. | know that the media is going io ty to 
frame my moomecty, Sut y'al wil know the truth! Im probably going to de today. Keep up he good Sight. 


> Anonymous 06/05/19 (Sat) 11:17:38 ID: 10c7fa No. 13569050 
>> 13561044 0P} 
Helio FB: 


P Anonymous 06/03/19 (Sat) 11:20:32 ID: S8B20b No. 13561062 
Fie gecek Tet SET TS haa: po (4.68 aB. De recent Tet ot} 20 Ww 


\ FML nervous as hell This is the actus’ manifesto Fuck Bis is going 10 be so shit but | cant wait any longer. Do your part and spread tis brothers! Of course, only spread È ff the 
\ attack is successful. | know that the meda is going to try io tame my incorrecty, Sut y'al will know the tuth! fm probably going o die today Keep up the good ght 


Figure 48 Crusius’ OP, posted to 8chan shortly before he opened fire on a crowded Walmart, killing and wounding dozens. 


A written submission to Congress by Watkins’ lawyer seeks to present 8chan as “careful and 
responsible” and claims it “has never tolerated illegal speech and has a consistent track record of 
working with law enforcement agencies when appropriate” .?*4 The statement says “8chan has taken 
steps to improve its ability to identify illegal content and to act more quickly in doing so. To these ends, 
it hopes to be of continued assistance to law enforcement officers in times of need” .3 It also claims 
“8chan is the only platform featuring a full commitment to free speech” and that only “a small minority 


of users post hateful and ignorant items” .?°° 


While stating that “we understand that the restriction of some speech is necessary”,*?” the 8chan 
submission makes it clear that this only applies to content which is unlawful in the United States. The 
United States is an exception internationally as the First Amendment to the United States Constitution 
has been held by the Supreme Court to also apply to hate speech. That means laws seeking to make 
hate speech illegal are in the United States unconstitutional. This does not prevent US companies from 
voluntarily creating and enforcing community standards under which hate speech is banned, but they 
cannot be forced to do by US law makers. 


The US position is exceptional as can be seen in the reservation the United States lodged when ratifying 
the International Convention on the Elimination of All Forms of Racial Discrimination in 1994 (28 years 
after first singing the treaty):3°8 


The Senate's advice and consent is subject to the following reservations: (1) That the 
Constitution and laws of the United States contain extensive protections of individual 
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freedom of speech, expression and association. Accordingly, the United States does 

not accept any obligation under this Convention, in particular under articles 4 and 7, 
to restrict those rights, through the adoption of legislation or any other measures, to 
the extent that they are protected by the Constitution and laws of the United States. 


The rejected article 4 says that state will “condemn all propaganda and all organizations which are based 
on ideas or theories of superiority of one race or group of persons of one colour or ethnic origin, or 
which attempt to justify or promote racial hatred and discrimination in any form”.?%° It also says states 
will make an offence punishable by law “all dissemination of ideas based on racial superiority or hatred, 
incitement to racial discrimination, as well as all acts of violence or incitement to such acts” .3“° This is 
what other countries have accepted, but the United States has rejected. Article 7, also rejected by the 
United States, is an obligation on states to combat prejudice leading to racial discrimination through 
education. 


This view is in stark contrast to, for example, the Council of Europe who adopted the “Additional 
Protocol to the Convention on Cybercrime, concerning the criminalisation of acts of a racist and 
xenophobic nature committed through computer systems” in 2003.34? The Additional Protocol commits 
states to pass legislation to criminalise “distributing, or otherwise making available, racist and 
xenophobic material to the public through a computer system” >“ making threats against a person or 
group on the basis of “race, colour, descent or national or ethnic origin, as well as religion” 347 


8chan is aware the US position is exceptional but made clear its position that it won’t limit speech unless 
it is unlawful in the United States. This is another way of saying it will intentionally do nothing to prevent 
the spread of hate speech and incitement to hate. The submission to congress explains: 34 


My company has no intention of deleting constitutionally protected hate speech. | 
feel the remedy for this type of speech is counter speech, and I'm certain that this is 
the view of the American justice system. This may be a contrary opinion to our friends 
in other countries. Those across the oceans may feel it necessary to stifle the voice of 
minority opinions. This is not what I intend to do. 


339 International Convention on the Elimination of All Forms of Racial Discrimination, adopted and opened for 
signature and ratification by General Assembly resolution 2106 (XX) of 21 December 1965, entry into force 4 
January 1969. https://www.ohchr.org/en/professionalinterest/pages/cerd.aspx 
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343 Additional Protocol, Article 4. 
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This immediately limits the cooperation with law enforcement as much of what is unlawful in other 
countries, in efforts to prevent the spread of hate and violence, will be actively permitted and protected 
on 8chan. The submission to congress makes this intention explicit saying “Beyond minute categories of 
unprotected speech remain all sorts of uneducated, ill-informed, and conspiratorial opinions. These 


remain protected under the First Amendment and protected by 8chan”.*4° 


7.6.4 Return as 8kun 

Watkins announced the relaunch and rebranding of 8chan to 8kun with a video on October 7, 2019.34 
The video features the new logo appearing out of an explosion and then morphing into a logo of a black 
flag waving in a thunderstorm. The video has been viewed 445,600 times and retweeted 6,900 times. 


From the start this was not the creation of a new board, but rather the same 8chan with content and 
accounts migrated to the new service (see Figure 49 and Figure 50). The rebranding and technical 
changed allow 8chan to side step a range of efforts to control the flow of extremist materials, including 
a ban on 8chan which was imposed by Australia’s eSafety Commissioner.*"” 


8chan (8ch.net) @ @infinitechan 
lf you were previously a Board Ow 
admin@8kun.net with your sha 


your board to 8kun. 


Figure 49 In a tweet 8chan board owners were invited to migrate to 8kun 


8chan (8ch.net) @ @infinitechan - Nov 2 
Migration is still ongoing, some boards have a lot of content. Existing 
accounts for boards that are already migrated should work just the same. 


f everything goes right, tomorrow morning might be it. 
Board migration will continue after launch. 


tl 4.8K 


Figure 50 8kun started by migrating content and accounts from 8chan 


RECOMMENDATION 31: Decisions by technology companies not to do business with a site should be 
general enough that a change to the ownership, brand, domain name or IP address will not circumvent 
the ban. 


345 Congressional Primer on 8chan, Committee on Homeland Security 8chan Inquiry, Submission to the Committee 
on Homeland Security, 4 September 2019, page 2. Accessible via https://www.benjaminbarr.com/news-updates 
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RECOMMENDATION 32: Decisions by governments to restrict access to a site should be robust enough 
that a change to the ownership, brand, domain name or IP address of the banned site will not 
circumvent the restriction. Government may need to monitor and update identification details to 
enforce such restrictions. 


An ongoing battle has been wages between activists and 8chan in which companies providing the 
technology to keep 8chan online have been named and shamed in to dropping 8chan / 8kun, or failing 
that, have found their own service cut off from further upstream.*“° These are voluntary actions by 
technology companies rather than a result of legislation. This demonstrate that companies may no 
longer be immune from criticism and boycotts if they provide the infrastructure that enables others to 
keep hate online. 


RECOMMENDATION 33: All companies providing Internet infrastructure should have clear terms of 
service which prohibit the use of their service for inciting hate or violence. They should also give notice 
that the service may be terminate without notice for serious breaches of this rule. Companies may 
further wish to require that any customer they provide a service to includes a similar statement in its 
terms of service. 


8 Responding to the Online Sub-Culture of Hate and Violent Extremism 


8.1 Hardening Targets to Reduce Antisemitic Attacks 

The Jewish community has been subject to many terrorist attacks from a range of ideologies over the 
years, including at a Jewish centre in Mumbai (India) in 2008,2*° the United States Holocaust Memorial 
Museum shooting in Washington DC in 2009,?°° a Jewish school in Toulouse (France) in 2012,°? a kosher 
supermarket in Paris (France) in 2015,3? the Great Synagogue in Copenhagen (Demark) in 2015,3? the 
Tree of Life synagogue in Pittsburgh (USA) in 2018,” and the Poway Synagogue near San Diego (USA) 
earlier in 2019.°°° As a result, Jewish communities around the world have developed security protocols, 
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down/; Robert Evans and Fredrick Brennan, “The State of California Could Have Stopped 8Chan: It Didn’t”, 4 
November 2019 https://www.bellingcat.com/news/2019/11/04/the-state-of-california-could-have-stopped- 
8chan-it-didnt/ 

343 “Mumbai Jewish centre targeted in 2008 terrorist attacks reopens”, The Guardian, 26 August 2014 
https://www.theguardian.com/world/2014/aug/26/mumbai-jewish-centre-chabad-lubavitch-reopens 

350 “Guard Killed In Holocaust Museum Shooting”, CBS News, 10 June 2009 
hitps://www.cbsnews.com/news/guard-killed-in-holocaust-museum-shootin 

351 Tzvi Fleischer and Sharyn Mittelman, “Jinadism, Antisemitism and the truth about the Toulouse murders”, ABC 
Religion and Ethics, 30 March 2012 https://www.abc.net.au/religion/jihadism-antisemitism-and-the-truth-about- 
the-toulouse-murders/10100670 

352 Andre Oboler, Je Suis Humain: Responsible free speech in the shadow of the Charlie Hebdo murders, (Online 
Hate Prevention Institute, 2015) http://ohpi.org.au/jesuishumain/ 

353 “Copenhagen shootings: Police kill 'gunman' after two attacks”, BBC News, 15 February 2015 
https://www.bbc.com/news/world-europe-31475803 

354 Chelsea Garbell, “After Tree of Life attack, don't tell Jews all hate crimes & bigoted attacks are the same”, USA 
Today, 8 November 2018 https://www.usatoday.com/story/opinion/voices/2018/11/08/jews-anti-semitism- 
shooting-pittsburgh-europe-hate-crime-column/1890066002/ 

355 Andre Oboler, “San Diego Synagogue Attack”, Online Hate Prevention Institute, 28 April 2019 
https://ohpi.org.au/san-diego-synagogue-attack/ 


88 


and hardened their physical infrastructure, protecting their institutions and spaces with both guards and 
secure doors and barriers. 


This was affective in Halle as the reinforced door proved an effective barrier and stopped the gunman 
entering the Synagogue and causing the high level of casualties that were seen in the synagogue in 
Poway and the mosque in Christchurch. The heavy security dissuaded the attacker from engaging in 
additional reconnaissance and limited his ability to gain useful intelligence to better plan the attack. He 
was unable to get through the door despite anticipating that it would be secured and despite his 
attempts to shoot it open. 


This is not the first time that casualties have been reduced due to security. In the 2015 at on the Great 
Synagogue in Copenhagen a community volunteer on security duty, Dan Uzan, questioned the attacker 
when he approached the synagogue. This led to the attack being triggered outside the synagogue rather 
than inside. Dan tragically gave his life protecting his community, but he stopped what could have been 
a far more deadly attack on the community. 


It is unfortunate that communities need to live within this sort of security, however, so long as these 
attacks and the incitement for such attacks remain regular occurrences, governments and other national 
bodies should provide or contribute to the costs of security. They should also provide additional support 
at times of increased risk, such as during Yom Kippur. 


In Australia the Federal Government recently announced $5.7 million to improve safety and security for 
Jewish schools and religious institutions in the state of NSW.°°° The funding comes from a multi-round 
Safer Communities Fund and is part of $41.9 million released in the current round.357 In the state of 
Victoria the government allocated $3 million “towards making Jewish community centres safer and 
more secure” with funding being applied to “organisations and sites with the greatest need” as 
identified through a collaborative approach with the peak community body the Jewish Community 
Council of Victoria and its subsidiary the Community Security Group.?** This is an addition to a further 
million allocated to the security upgrades for a community centre which houses many of the Jewish 
communal organisations.’ The Halle attack demonstrates that proper physical security can save lives 
and we commend both the Federal and Victorian Government for the steps they have taken. 


RECOMMENDATION 34: Governments continue to contribute to the costs of security for Jewish 
communal institutions and provide additional support at times of increased risk such as during Yom 
Kippur. 


8.2 Taking Down the Online Infrastructure of Extremism 

The Internet is a network of networks. For content to appear on the Internet it needs to physically reside 
ona hard drive inside a server. Space on the server may be rented from a company (a hosting provider) 
that owns and manages the server, or a person may host material on a computer they own themselves. 
To connect the material on the server to others on the internet, the physical computer with the material 


356 “$5.7 million federal security grants for Jewish schools and institutions within Wentworth”, J-Wire, 16 October 
2019 <http://www.jwire.com.au/5-7-million-federal-security-grants-for-jewish-schools-and-institutions-within- 
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needs to have a connection to the Internet. This means the hosting company (or individual who owns 
the computer) must be a customer of an Internet Service Provider (ISP). Even if the hosting company is 
itself an ISP, it must purchase bandwidth from a higher stream ISPs. Even in the case of large ISPs who 
run their own large networks using their own infrastructure such as cable and copper wires, at some 
point their network needs to connect to other networks, undersea cables or satellites. Beyond the 
hardware and wires, to exist on the surface web, a site also needs a domain name. These are purchased 
from domain name registrars who are licensed to sell domains under existing higher-level domains by 
the domain name owner. To sell a top-level domain (such as one ending in .com) a domain registrar 
must be accredited by the Internet Corporation for Assigned Names and Numbers (ICANN). 


This infrastructure means a site can be taken off the internet if: 


e The company that owns the servers hosting the content terminates the account 
e The company the supplies the internet connectivity to the servers terminates their service 
e The company that supplies the domain name terminates its use 


In the last two cases if a company that is directly providing such a service fails to take action, it can itself 
become the subject of termination by its supplier. While small companies might be more willing to profit 
from the spread of hate and care little for their reputation, the larger companies that supply them with 
services may susceptible to public pressure. This could take the form of adverse publicity or a direct 
consumer boycott. Even companies who do not deal directly with the public may be subjected to 
pressure when other businesses and government entities refuse to do business with them. 


A problematic site, particularly a popular one, may also be protected through its use of a Content 
Delivery Network (CDN) service. A CND service mirrors the content on a customer's site allowing it to be 
delivered from a cached copy on the CDN’s servers rather than directly from the client’s servers. This 
can prevent DDOS (distributed denial of service) attacks and the CDN can replicate the content as 
needed to cope with an increased load, while also taking action against spurious traffic. One effect of a 
CDN is that as the content is accessed on the CDN’s server rather than the clients, a trace to see who is 
providing the connectivity will stop at the CDN. While CDNs play a powerful role in protecting sites, they 
also carry a heavy burden in ensuring such protection is only provided when it is ethical to do so. 


This means it would be accessed on’s servers rather than the clients. A 


8.2.1 Lessons from Cloudflare’s termination of 8chan 

The first company to act against 8chan was Cloudflare, a Content Delivery Network, who on August 5* 
2019 terminated their services to 8chan after the El Paso attack.3® The announcement by Cloudflare’s 
CEO Matthew Prince notes that:?™ 


e “the suspected terrorist gunman appears to have been inspired by the forum website known as 
8chan” and specifically by “largely unmoderated discussions on 8chan which glorified the 
previous massacre” in Christchurch 

e the attacks in El Paso, Poway and Christchurch all involved posts to 8chan and that “8chan has 
repeatedly proven itself to be a cesspool of hate” 


360 Matthew Prince, “Terminating Service for 8Chan”, Cloudflare Blog, 5 August 2019 
https://blog.cloudflare.com/terminating-service-for-8chan/ 
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e “they have proven themselves to be lawless and that lawlessness has caused multiple tragic 
deaths. Even if 8chan may not have violated the letter of the law in refusing to moderate their 
hate-filled community, they have created an environment that revels in violating its spirit” 


He goes to explain, “We reluctantly tolerate content that we find reprehensible, but we draw the line at 
platforms that have demonstrated they directly inspire tragic events and are lawless by design. 8chan 
has crossed that line. It will therefore no longer be allowed to use our services.”3 


The response from Matthew Prince continues noting that they only act very reluctantly and seldomly in 
this manner. He explains this is not a First Amendment issue as Cloudflare is “a private company and not 
bound by the First Amendment”. He explains “The only relevance of the First Amendment in this case 
and others is that it allows us to choose who we do and do not do business with; it does not obligate us 
to do business with everyone.”3° He commits to working not only with law enforcement, but also with 
governments and civil society. Highlighting the importance of the Rule of Law and the sovereign right of 
each country to determine what it permits and what it prohibits, Prince discusses the need for 
boundaries to be set on a country by country basis in a politically legitimate manner, rather than by 
companies:°“ 


Questions around content are real societal issues that need politically legitimate 
solutions. We will continue to engage with lawmakers around the world as they set 
the boundaries of what is acceptable in their countries through due process of law. 
And we will comply with those boundaries when and where they are set. 


He notes Europe’s lead in responding to the problem of online hate and extremism and the distinction 
and resulting differing obligations that apply between companies that “organize and promote content — 
like Facebook and YouTube — rather than those that are mere conduits for that content” .© This 
distinction has arisen as the idea that a platform like Facebook or YouTube should have no liability as it 
is not a publisher has fallen away in the face of significant evidence over the control they companies 
have over the visibility or lack of visibility of content, and the way they manage this as part of their 
business model. 


RECOMMENDATION 35: Content services should create mechanisms that enable them to restrict access 
to specific content on their service for users from countries where that content is illegal. This will ensure 
content services have the technical capacity to respect national sovereignty and comply with national 
laws. There may be exceptional circumstances where a content service refuses to comply with national 
laws, for example, if the national laws conflict with customary international law, international treaties to 
protect human rights, or legal obligations in the content services own jurisdiction. 
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RECOMMENDATION 36: Hosting services that do not outright prohibit the use of their services to incite 
hate, should at a minimum ensure they don’t serve content inciting hate to users in countries where 
such incitement is unlawful. 


Prince notes that “the law may need additional remedies” when it comes to dealing with lawless 
platforms and suggests such law reform might “mean moving enforcement mechanisms further down 
the technical stack”. 36€ Such a move could mean creating legal liability for those who provide the 
infrastructure and connectivity to spread incitement to hate. 


RECOMMENDATION 37: Governments should consider law reforms to create a system of sanctions that 
could be imposed on companies outside their jurisdiction who, after suitable notice, continue to provide 
unlawful content inciting hatred or violent extremism to users in that country in breach of the country’s 
law. Such law reform could also create sanctions that impose penalties for any company within the 
country’s jurisdiction who engaged in business with a company on the sanctions list. 


8.2.2 The broader campaign to disconnect 8chan 
The use of activism to name and shame companies whose provision of services supported the delivery 
of incitement to hate and extremism can be seen in the wider campaign to keep 8chan offline.3°” 


Following its removal from Cloudflare, 8chan sought to move to a new Content Delivery Network called 
Bitmitigate, owned by domain registrar Epik.> In an initial statement the CEO of Epik, Rob Monster, 
said they did not solicit the business and would evaluate whether to provide the service, but stated that 
their “philosophy is, if the customer is not breaking the law, they are protected under our umbrella of 
services” .2° The statement also appeared to suggest it would be sufficient for a company to act on 
“content which is illegal in the United States” .?”° That would mean hate speech and incitement to hate 
would be permitted. 


Epik rents some of its server space from a company called Voxility who soon found that their servers 
were now being used to host 8chan. Voxility’s business development VP Maria Sirbu explained what 
happened next: “As soon as we were notified of the content that Epik was hosting, we made the 
decision to totally ban them” .?”t She noted that, “This is the second situation we’ve had with the reseller 
and this is not tolerable” explaining that it was unlikely Voxility would resume services to Epik. The 
removal of service to Epik also tool down the Daily Stormer which Epik was supporting.?” 
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Soon after Epik reversed course.?”* In deciding not to provide services for 8chan, Epik said, “In cases 
whereby Epik identifies a particular publisher as being under-equipped to properly enforce its own 
Terms of Service, Epik reserves the right to deny service” and that in this case the decision was “largely 
due to the concern of inadequate enforcement and the elevated possibility of violent radicalization on 


the platform” .?”4 


Evidence 8chan provided to Congress, documented earlier in this report, shows the moderation was in 
fact relatively fast on 8chan. The time from the post being made until it was removed was 2 hour and 49 
minutes for the Christchurch attack, 12 minutes for Poway and 45 minutes for El Paso.?”° For 
comparison, Facebook first received a report of the Christchurch livestream video 29 minutes after the 
livestream started (and 12 minutes after it ended),?”° and at least one copy of the video remained on 
Facebook for at least 6 hours while a copy remained on YouTube for at least 3 hours.?”” The manifesto 
from Poway remained on Pastebin for 50 hours and on Mediafire for at least 20 hours.?”° The real issue 
then is that 8chan creates an “elevated possibility of violent radicalization on the platform”. This speaks 
to the culture of 8chan and 8chan’s /pol/ in particular. 


The terminated service was not the hosting of the underlying 8chan site, just the Content Delivery 
Network service. Once it went down it was possible to find the address for the underlying 8chan server 
and the company providing them with that service. That turned out to be provided by a company called 
Centauri Communications.?”? A campaign was mounted against Centauri Communications who were 
supposed to be suspected by the Californian Secretary of State from doing business in that state.?%° 
While there was interest from a member of Congress in tackling this, there was also concern about 
potential reprisals and in particular the risk of swatting occurring.2** The fear further highlights why 
/pol/ has the characteristics of terrorism. The servers were eventually moved interstate to a company 
called VanWatTech set up by the founder of BitMitigate Nick Lim.38? 
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Another focus of the campaign is PayPal who are still providing financial services to collect donations for 
N.T. Technology, the company that ran 8chan and now 8kun (see Figure 51).°8? Given PayPal’s block on 
fundraising for Wikileaks,?** it seems strange they continue to provide financial services to a platform 
that supports hosting incitement to hate and a culture which has led to multiple terrorist attacks. 


N.T. Technology, Inc. 


Details of purchase 


100 


Continue 


P PayPal P PayPal 


Figure 51 Paypal donations to N.T. Technology Inc 


The campaign to name and shame can produce results. It is in fact a form of counter speech with people 
and companies expressing their dislike by steering clear of companies that are facilitating the spread of 
hate. While helpful in the absence of legal remedies, as Associate Professor Chris Demaske from the 
University of Washington-Tacoma has noted, this is leaving the decision making to companies and “at 
the end of the day, their job is to make money” and “not to promote democracy” which means policy 
will be driven by commercial and not civil imperatives.?*° 


8.3 Tackling the toxic culture 

The toxic culture on /pol/ which has resulted in multiple terrorist attacks is due to a combination of 
anonymity, hate speech as a cultural norm, a shared political ideology (the red pill ideology) and a 
willingness to engage in and to support criminal and even violent action that promotes the cause. 


Some in the /pol/ community are no doubt hardcore activists. Others are in it just for the thrill of being 
part of the unfolding train wreck; part of something that will make the news. Given their anonymity and 
the likely lack of any repercussions for them, they keep encouraging and egging on others to see what 
might happen. There is a game like culture with wins and high scores. The effort to spread fake news to 
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get the attack pinned on Rainer Winkler (Drachenlord) in the hours immediately after the attack 
highlight not only a lack of empathy and basic human dignity, but an outright reveling in cruelty. 


The idea of /pol/ as a “containment zone” for this poor behaviour doesn’t work. It allows the toxicity to 
concentrate. It establishes a new normal and, in the words of one poster, then allows that culture to 
"infected" other boards. Despite being anonymous, /pol/acks can move between /pol/ boards on 
different servers and reconnect with the community. The fact there are no lasting accounts and nothing 
to register or configure actually makes this easier and more resistance to the closure of a particular 
platform like 8chan. 


It isn't all bad as many on the various image boards are against the toxic culture. If there were a way to 
agree community standards democratically, the result might strengthen community standards and force 
the hate to leave. This is a technical challenge in an anonymous forum. It is also a political challenge as 
the Image boards are not run as democracies. Some who are there to troll and participate in causing 
chaos in society will leave if the culture improves on one board and will seek to join or create another. If 
image boards that will stand against the toxic culture, as 4chan did in gamergate, can be separated from 
those that tolerate the toxic culture, the problem is already reduced. If image boards that tolerate a 
toxic culture can be regularly disrupted through the loss of their suppliers, block imposed by state 
authorities or blocks at the ISP level, it will create an incentive for their owners to stamp out the toxic 
culture on their board. For those that won’t work to stamp it out, the disrupt to community will cause a 
drop off in participation and send a signal that the culture is unacceptable. There will still be individual 
bad actors, but their ability to coordinate, feed off each other and increase the intensity will be reduced. 
This disruption can still be effective in limiting growth and reducing harm. Where a board or forum's 
moderators are indifferent to illegal activity there should be legal penalties. 


Professional disruption efforts aimed at undermining hateful narratives and changing board sentiment 
and content can be used, but there are significant challenges to this approach. The users on /pol/ 
assume this is already happening and often jump at shadows. They dismiss the views of anyone being 
even remotely moderate, usually by accusing them of being a Jew. The push back can still create 
resistance and derail a downwards spiral. It can, however, be halted by those with administrator rights 
who may act to preserve the culture. 


Where there is support from board administrators, identifying users responsible for outsized influences 
of toxicity on /pol/ boards and selectively (and discretely) blocking them from the platform with IP 
based bans could be effective. At minimum it will disrupt them and increase their effort of participation, 
making it more likely they head to another platform. 


While /pol/ increases the toxicity to dangerous levels, it reflects discontent in segments of society. As 
with other fascist movements, it is those disillusioned with society who are more likely to join. Blaming 
minorities is always presented as an easier solution than the work required to solve societal problems. A 
more proactive and informed political discussion, in /pol/ on the issues impacting people in the 
community could help to reduce hostilities. 


In the end reducing the toxicity is something that needs to come from the image board community 
itself, but suitable pressure needs to be created on board owners who foster this toxicity. Suitable 
support needs to be provided to efforts within the image board community to speak out against 
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increases in toxicity. There need to be consequences and those consequences need to be triggered 
much earlier in the process. Once someone is announcing an imminent attack, it is too late. 


In the fact of an attack, everyone needs to their part and they should make it known they are doing this. 
Links sharing terrorist videos or manifestos should be report to authorities and where it is safe to do so, 
for example when posting anonymously, posts sharing this content should get a reply stating it has been 
reported. This will help establish a community standard against sharing such content as well as actively 
getting it removed. 


RECOMMENDATION 38: The public are urged not to share content from terrorist attacks such as 
manifestos or videos. If seen, this content should be reported to the relevant authorities, in Australia 
this being the eSafety Commissioner. 


8.4 Future Work 

While the specific image board culture is the focus of this report, there is a wider online culture which 
can either permit and encourage or prohibit and discourage the spread of incitement to hate and 
violence. 


The Online Hate Prevention Institute has developed tools for the public to report online antisemitism, 
categorised to reflect the IHRA Working Definition of Antisemitism, but which are able to be configured 
to cover other forms of hate as well. The latest version of the tool is able to be embedded in the website 
of other organisations and configured to meet their needs, both in terms of the types of hate that can 
be reported and the language of the user interface. 


The next step is a range of projects in partnership with organisations around the world to enable others 
to empower their community to report online hate while also facilitating empirical reports on the 
problem. There is also a training program to teach grassroots communities to identify, report and more 
generally respond to a range of different forms of hate speech. Subject to support from both donors and 
partner organisations we hope to roll this program out for both antisemitism and others types of hate 
through 2020. Our past Empirical report on Antisemitism?® and Islamophobia*”’ give an idea of what is 
possible. 


We invite potential partners, sponsors and donors for this larger campaign to contact us through our 


website: https://ohpi.org.au/contact-us/ 
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